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VOLUME  XIX 
IN  THE  UNITED  STATES  ARMY 

UNITED  STATES 
VS. 

MANNING,    Bradley  E.,    PFC  COURT-MARTIAL 
U.S.   Army,    xxx— xx— 9504 

Headquarters  and  Headquarters  Company, 

U.S.   Army  Garrison, 

Joint  Base  Myer— Henderson  Hall, 

Fort  Myer,   VA  22211 

 / 

The  Hearing  in  the  above— entitled  matter  was 
continued  on  Thursday,    July  18,    2013,    commencing  at  2:00 
p.m.,    at  Fort  Meade,   Maryland,   before  the  Honorable 
Colonel  Denise  Lind,  Judge. 
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DISCLAIMER 

This  transcript  was  made  by  a  court  reporter 
who  is  not  the  official  Government  reporter,   was  not 
permitted  to  be  in  the  actual  courtroom  where  the 
proceedings  took  place,   but  in  a  media  room  listening 
to  and  watching  live  audio/video  feed,   not  permitted  to 
make  an  audio  backup  recording  for  editing  purposes, 
and  not  having  the  ability  to  control  the  proceedings 
in  order  to  produce  an  accurate  verbatim  transcript . 

This  unedited,    uncertified  draft  transcript 
may  contain  court  reporting  outlines  that  are  not 
translated,   notes  made  by  the  reporter  for  editing 
purposes,   misspelled  terms  and  names,   word  combinations 
that  do  not  make  sense,    and  missing  testimony  or 
colloquy  due  to  being  inaudible  by  the  reporter. 
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PROCEEDINGS, 
(Reconvened  at  2:30  p.m.) 

THE  COURT :      The  Court  is  called  to  order . 
Major  Fein.     According  to  the  Court's  last  recess  all 
present  with  the  exception  Captain  Morrow  is  out  and 
Captain  Whyte  is  present.     Also,    Your  Honor,  Captain 
Von  Elsten  is  absent,    Captain  Bouregard  is  present. 

MR.   COOMBS:      Just  one  quick  alibi  on  the 
641  argument.      I   just  wanted  to  point  out  on  the 
databases  both  the  CIDNE  —  on  the  CIDNE-I  and  CIDNE-A 
database  you  have  testimony  from  witnesses  that  the 
database  was  made  up  of  multiple  tables,   SigActs  were 
one  of  those  tables.     You  also  had  counter  ID,   you  had 
PSYOPS .     You  had  Humity  reports,   but  these  were  other 
tables  under  the  CIDNE-I  and  CIDNE-A  database . 

The  database  was  not  made  exclusively  of 

SigActs . 

THE  COURT:     Who  was  that  witness,    do  you 

remember? 

MR.   COOMBS:     All  of  the  unit  witnesses  that 
testified  for  the  government.      So  all  of  the  unit 
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witnesses  talked  about  the  other  things  on  the  CIDNE— I 
or  CIDNE— A  database . 

THE  COURT:      Government,    do  you  contest 

that . 

MAJOR  FEIN:     Your  Honor,    United  States 
doesn't  necessarily  contest  that  the  CIDNE  system 
had  other  types  of  information  in  it  which  the 
United  States  says  that  testimony,   but  was  charged 
with  the  CIDNE  database  containing  certain  number  of 
SigActs .      So  it's  a  focus  on  the  SigActs  side  of  the 
database . 

THE  COURT :     All  right .     Before  we  proceed  I 
was  advised  over  the  lunch  recess  that  at  an  earlier 
proceeding  today  there  was  a  cell  phone  or  other 
digital  device  in  the  courtroom.      I'll  remind  the 
public  once  again  the  rules  of  Court,   you  cannot  have 
cell  phones  or  digital  devices  in  the  courtroom.  We 
have  not  had  an  issue  since  the  trial  began  and  I  just 
bring  it  to  your  attention .     You  have  to  keep  them  out 
of  the  courtroom.      If  I  find  that  there's  continuous 
violations  of  rules,   The  Court  may  have  to  increase  the 
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procedures  for  searches  and  all  of  that  before  you  come 
in  here  and  I  really  don't  want  to  do  that.      I  just 
bring  that  to  your  attention. 


Are  we  ready  to  proceed? 

MAJOR  FEIN:     Yes,  ma'am. 

MR.   COOMBS:     Yes,    Your  Honor. 

THE  COURT:     Major  Fein? 

CAPTAIN  OVERGAARD:     Ma'am,  defense 


witness  is  being  recalled  to  continue  his  cross 
examination . 

THE  COURT:  So  you're  reopening  your  case; 
is  that  right? 

CAPTAIN  OVERGAARD:  Well,  it's  the  defense 
case  technically  made  it .     Okay . 


THE  COURT: 


Go  ahead . 


EXAMINATION  BY  CAPTAIN  OVERGAARD: 


BY  CAPTAIN  OVERGAARD: 


Q 


Chief  Ehresman,    I   just  remind  you  that 


you're  still  under  oath. 


A 


Yes ,   ma  '  am . 


Q 


You  last  testified  on  8  July  2010  and  at 
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that  time  you  testified  that  you  arrived  in  Iraq  in 
November  of  2009;    is  that  correct? 
A  Yes ,   ma ' am . 

Q  And  then  that  was  later  in  the  2010  because 

you  had  surgery? 

A  Yes ,   ma ' am . 

Q  So  you  didn't  have  the  opportunity  to  do 

the  right  seat  left  seat? 
A  Yes,  ma'am. 

Q  And  you  got  the  lay  of  the  land  when  you 

got  in  theater  by  basically  talking  to  other  soldiers 
who  were  working  around  you? 

A  Yes ,   ma ' am . 

Q  When  you  got  in  theater  you  discovered  that 

there  was  a  program  that  you  needed  to  run  on  your 
computer  to  do  your  job;    is  that  correct? 

A  Yes,  ma'am. 

Q  And  you  didn ' t  have  that  program  on  your 

computer? 

A  That ' s  correct . 

Q  Was  that  a  media  player? 
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A  Yes . 

Q  And  everyone  else  in  the  S2  shop  already 

had  the  media  player  installed  on  their  machine? 
A  Yes . 

Q  So  someone  from  the  S2  stop  give  you  that 

media  player  on  a  disk? 
A  Yes,  ma'am. 

Q  Ands  you  tried  to  install  the  media  player 

but  you  weren't  allowed  to  do  so? 
A  Yes,  ma'am. 

Q  Ands  you  explained  that  administrator 

privileges  came  up  when  you  tried  to  do  that? 
A  Yes ,   ma  '  am . 

Q  And  then  someone  in  the  S2  told  you  that 

you  could  run  the  program  on  a  disk? 
A  Yes ,   ma ' am . 

Q  And  just  you  couldn't  install  anything? 

A  Correct ,   ma ' am . 

Q  So  did  this  person  then  show  you  how  you 

can  run  this  program  from  a  disk? 
A  Yes ,   ma  '  am . 
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Q  And  then  after  that  did  you  go  to  Mr . 

Millman  and  ask  him  to  install  that  program  on  your 
computer? 

A  Yes ,   ma ' am . 

Q  And  he  had  to  go  and  check  ands  make  sure 

that  he  could  actually  installment  the  program  on  your 
computer? 

A  Yes,  ma'am. 

Q  And  he  said  he  would  get  back  to  you? 

A  Yes,  ma'am. 

Q  So  in  the  meantime  you  ran  that  media 

program  from  the  disk? 

A  Yes ,   ma  '  am . 

Q  And  you  had  a  shortcut  to  your  CD  player? 

A  Yes,  ma'am. 

Q  Because  it  was  faster  than  clicking  through 

everything  on  your  desktop? 
A  Yes ,   ma ' am . 

Q  So  then  a  few  days  later  Mr .   Millman  came 

back  to  you  and  installed  the  media  player  on  your 
program  or  D6A  computer? 
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A  Yes ,   ma  '  am . 

Q  And  after  that  you  did  not  have  to  access 

any  programs  from  disks? 

A  That ' s  correct ,   ma ' am . 

Q  Because  everything  you  needed  was  already 

on  your  computer? 
A  Yes . 

Q  And  you  testified  that  even  mIRC  Chat  was 

on  your  computer  when  you  got  there? 
A  Yes,  ma'am. 

Q  You  don ' t  remember  anyone  else  running  any 

programs  from  disks? 

A  No ,   ma ' am . 

Q  Did  this  all  happen  soon  after  you  arrived 

at  FOB  Hammer? 

A  Yes ,   ma ' am . 

Q  And  that  was  November  2009  time  period? 

A  Correct . 

Q  When  you  spoke  to  Mr .   Millman  about  the 

media  player  he  told  you  that  you  were  weren ' t  allowed 
to  adds  programs  to  D6A  machines  because  they  didn't 
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belong  to  210;   is  that  correct? 
A  Yes ,   ma  '  am . 

Q  And  he  told  you  only  he  could  authorize 

anything  on  the  D6A  machines? 
A  That ' s  correct . 

Q  He  actually  told  you  he  didn't  want  you 

saving  files  on  your  desktop? 
A  Yes,  ma'am. 

Q  When  you  testified  before  on  8  July  you 

said  that  Mr.   Millman  told  you  you  could  run 
executables  on  a  CD .     Do  you  actually  remember  Mr . 
Millman  telling  you  that? 

A  No ,   ma ' am . 

Q  In  fact,   no  one  ever  said  anything  about 

executable  until  in  Mr.   Coombs  explained  to  you  what  an 
executable  was  a  couple  of  months  ago  you  didn't  know 
what  that  term  meant? 

A  Yes ,   ma  '  am . 

Q  But  you  remember  hearing  that  you  were  able 

to  run  anything  from  a  desktop  from  someone  in  the  S2 
shop? 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


13 


A  Yes ,   ma  '  am . 

Q  And  you  assume  when  you  last  testify  it  was 

Mr.  Millman  because  you  went  to  Mr.  Millman  with  all  of 
your  D6A  questions  and  issues? 

A  Yes,  ma'am. 

Q  But  you  don't  remember  who  actually  told 

you,  if  anyone,  that  you  could  actually  run  programs 
from  that  CD? 

A  Yes . 

Q  Actually  someone  in  that  unit  that  set  that 

up  for  you? 

A  Yes ,   ma ' am . 

Q  And  just  to  clear  up  an  confusion  from  your 

testimony  as  well,   you  last  testified  you  said  that  it 
was  VLC  on  the  CD? 

A  Yes ,   ma  '  am . 

Q  But  you're  not  actually  sure  that  was  VLC? 

THE  COURT:      What  is  VLC? 

THE  WITNESS:      It's  a  type  of  media  player, 

ma ' am . 

BY  CAPTAIN  OVERGAARD: 
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Q  But  you're  not  actually  sure  it  was  VLC? 

A  No. 

Q  But  you  know  it  was  a  media  player? 

A  Yes ,   ma  '  am . 

Q  So  to  summarize,   you're  sure  that  you 

cannot  put  anything  on  your  D6A  computer  without  going 
through  Mr.  Millman? 

A  Yes,  ma'am. 

Q  Ands  you  remember  someone  in  the  S2  telling 

you  that  you  could  run  anything  off  a  desk,   you  just 
don't  remember  who  that  was? 

A  Yes ,   ma  '  am . 

Q  Was  there  ever  a  time  after  you  arrived 

that  Mr.   Millman  pulled  everyone  in  the  shop  aside  just 
to  ensure  that  they  understood  that  no  one  was  allowed 
to  add  anything  to  their  D6A  machines? 

A  Yes . 

Q  Do  you  remember  when  that  was? 

A  January  February  timeframe. 

Q  When  was  this?     Was  this  at  a  shift  change? 

A  Yes ,   ma  '  am . 
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Q  So  was  everyone  in  the  unit  present  at  that 

time? 

A  Everybody  in  the  shop  that  was  in  country 

was  at  that  shift  change . 

Q  Did  that  include  PFC  Manning? 

A  Yes ,   ma ' am . 

CAPTAIN  OVERGAARD:      Thank  you. 
CROSS  EXAMINATION  BY  MR.  COOMBS: 
BY  MR.  COOMBS: 
Q  Chief  Ehresman,    let's  talk  what  about  you 

know .     DO  you  know  if  anyone  had  mIRC  Chat  as  an 
executable  file  on  their  desktop? 
A  Yes,  sir. 

Q  Did  you  know  in  PFC  Manning  had  mIRC  Chat? 

A  Yes,  sir. 

Q  So  I  guess  that  would  be  an  example  of 

somebody  other  than  Milliman  adding  something  to  a  D6A 
computer? 

A  Yes,  sir. 

Q  When  you  were  I  guess  honing  in  on  the 

brigade  a  month  later,   you  indicated  that  your 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


16 

understanding  was  that  you  could  add  —  you  could  run 
executable  files  from  a  CD;   is  that  correct? 
A  Yes,  sir. 

Q  Let ' s  go  ahead  and  go  through  what  you  know 

from  the  S2  side .     Did  anyone  in  the  S2  section  say 
that  you  could  not  run  an  executable  file  from  a  CD? 

A  No,  sir. 

Q  Did  anyone  in  the  S2  section  say  that  you 

could  not  put  a  shortcut  on  your  desktop  to  run  an 
executable  file  from  a  CD? 

A  No,  sir. 

Q  Did  anyone  in  the  S2  section  say  that  you 

could  not  put  an  executable  file  on  the  desktop  and  run 
it? 

A  No,  sir. 

Q  With  regards  to  Mr.   Millman,   when  he  pulled 

everyone  in  his  group,   did,   he  at  that  point,    say  you, 
can't  put  games  and  music  and  executable  files  on  your 
desktop? 

A  Yes,  sir. 

Q  So  he  specifically  said  he  thought  you 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


17 


could  not  do  that,   you  shouldn't  be  able  to  do  that? 
A  Yes,  sir. 

Q  And  do  you  know  if  every  soldier  had  music 

and  games  on  their  D6A  machine? 
A  Yes,  sir. 

Q  So  I  guess  Milliman  said  it  and  soldiers 

didn't  follow  what  Milliman  said? 

A  Or  it  was  already  on  there . 

Q  Fair  enough .     And  with  regards  to  Milliman 

he  wasn't  in  the  military? 
A  No,  sir. 

Q  He  was  the  civilian  person  contracted  to 

work  on  the  D6A  machines? 

A  He  was  one  of  them,   yes,  sir. 

Q  And  with  regards  to  the  military  chain  of 

what  you  could  and  could  not  do  on  D6A  computer,  it  was 
the  S2  and  above  that  kind  of  controlled  what  you  do? 

A  Yes,  sir. 

Q  And  did  the  S2  ever  put  out  —  and  I  know 

Mr.   Millman  had  his  little  group  together,   but  did  the 
S2  Captain  Lamb  or  his  predecessor    (INAUDIBLE)  pull 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


18 

everyone  together  and  say  no  more  games,   music,  movies 
executable  files  on  you  D6A  machine? 

A  Not  until  after  Private  Manning  get  in 

trouble . 

Q  So  after  Manning  got  in  trouble  that ' s  when 

the  S2  actually  put  that  out? 
A  Yes,  sir. 

Q  And  prior  to  that? 

A  No,  sir. 

REDIRECT  EXAMINATION  BY  CAPTAIN  OVERGAARD : 

BY  CAPTAIN  OVERGAARD: 
Q  DID  you  ever  see  anyone  put  the  music  and 

games  in  the  D6A  machines? 
A  No ,   ma ' am . 

Q  You  just  assumed  it  was  on  the  T— Drive 

already? 

A  Yes ,   ma ' am . 

Q  And,    again,   Mr.   Millman  told  you  that  only 

he  could  authorize  adding  things  to  the  D6A  machines, 
correct? 

A  Yes ,   ma  '  am . 
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Q  He  didn't  necessarily  say  I  must  do  it? 

A  Right .      That ' s  correct . 

Q  And  defense  asked  you  again  about 

executables,   but  you  didn't  know  what  they  were,  did 
you? 

A  Not  at  that  time. 

Q  Or  self -executables? 

A  Yes,  ma'am. 

Q  Thank  you. 

THE  COURT:      Go  ahead. 
RECROSS  EXAMINATION  BY  MR.  COOMBS: 

BY  MR.  COOMBS: 
Q  The  term  executable,    is  that  you 

understand? 

A  Yes . 

Q  You  understood  that  certain  things  could  be 

double  clicked  and  run  from  a  CD  or  from  a  desktop, 
right? 

A  Yes,  sir. 

Q  So  that  was  knowledge  you  had  you  just 

didn't  know  about  being  called  an  executable? 
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A  That ' s  correct . 

MR .   COOMBS :      Thank  you . 

THE  COURT :      Talk  to  me  about  the  video 
players .     Once  again  what  happened  when  you  first  got 
into  the  country  with  the  media  player? 

THE  WITNESS :      The  media  player  because 
there  was  various  amounts  of  my  media  players  and  some 
play  on  some  and  some  wouldn't  play  on  others.  If 
you're  looking  at  a  file  or  a  movie  sometimes  you  need 
a  specific  video  player  to  watch  that  specific  video. 

So  I  didn ' t  have  it  on  my  computer .  So 
it  was  given  to  me .      So  I  used  it  until  I  got  to  Mr . 
Millman . 

THE  COURT :     You  said  it  was  given  to  you . 
How  was  it  given  to  you? 

THE  WITNESS:     On  a  CD,   ma'am.     And  after  I 
had  problems  with  it  and  I  was  tired  of  pull  it  out  and 
putting  in  another  one  back  and  forth  transitioning  I 
went  to  Mr .   Millman  and  he  corrected  it  for  me . 

THE  COURT:      So  at  the  time  you  were  using 
the  media  player  when  you  subsequently  found  out  from 
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Mr.   Millman  that  you  weren't  supposed  to  use  files  or 
software  from  a  CD.     Did  you  know  that  when  you  were 
using  the  media  player? 

THE  WITNESS:     No,  ma'am. 

THE  COURT :     Were  other  soldiers  in  the  SCIF 
also  using  things  from  CDs  like  the  media  player? 

THE  WITNESS:      I  don't  know. 

THE  COURT:     Any  follow-up  based  on  that? 

CAPTAIN  OVERGAARD:     Yes,  ma'am. 
REDIRECT  EXAMINATION  BY  CAPTAIN  OVERGAARD: 

BY  CAPTAIN  OVERGAARD: 
Q  You  don ' t  remember  anybody  else  running 

programs  from  disks? 

A  No ,   ma ' am . 

Q  Everyone  else  in  the  shop  besides  you  had 

the  program  you  remember  running  from  the  disk  already 
on  their  computer? 

A  Yes ,   ma ' am . 

MR.  COOMBS:  Nothing,  Your  Honor. 
THE  COURT :  I  have  one  other  one . 
Could  you  take  something  from  a  NIPR 
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computer  on  a  CD  and  put  in  it  a  SIPR  or  D6A. 
THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     Any  follow-up  based  on  that? 

MR .   COOMBS :     No ,   Your  Honor . 

CAPTAIN  OVERGAARD:      No,  ma'am. 

THE  COURT:      Temporarily  or  permanently 

excusable . 

MR.   COOMBS:      Temporary,    Your  Honor. 

THE  COURT:     You  are  excused.  Pleased 
don't  discuss  your  testimony  or  knowledge  of  the 
case  with  anyone  other  than  counsel  or  the  accused 
while  the  trial  is  still  going  on. 

MR.   COOMBS:     We  would  ask  that  Chief 
Ehresman  stay  for  the  day .      The  only  reason  depending 
upon  what  the  government  elicits  in  his  rebut  case.  He 
may  have  information  in  surrebuttal . 

THE  COURT:     Any  objection? 

MAJOR  FEIN:      To  stay,    no,   Your  Honor. 

THE  COURT:  So. 

CAPTAIN  WHYTE:     United  States  recalls 
Mr.    Jason  Milliman. 
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DIRECT  EXAMINATION  BY  CAPTAIN  WHITE: 
BY  CAPTAIN  WHYTE: 
Q  Mr.   Millman,    just  to  remind,   you're  still 

under  oath . 

A  Yes,  sir. 

Q  Let ' s  talk  a  little  bit  about  the  use  of 

CDs  on  the  D6A  machines.     What,    if  any,  physical 
restrictions  were  in  place  that  prevented  a  soldier 
from  putting  a  file  on  a  CD  putting  the  CD  into  the  D6A 
machine  and  then  running  the  file  —  running  the  file 
from  the  CD? 

A  No  visible  restrictions . 

Q  Were  soldiers  authorized  to  put  an 

unauthorized  executable  file  on  a  CD,   put  that  CD  in 
the  D6A  machine  and  run  the  unauthorized  executable 
file? 

A  No. 

Q  Why  not? 

A  Because  it  was  unauthorized. 

Q  How  do  soldiers  know  what  was  or  was  not 

author i  zed? 
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A  They  could  come  to  me.      If  I  didn't  know 

the  answer  I  would  he  seek  guidance  whether  it  was 
authorized  or  not. 

Q  What,    if  any,   physical  restrictions  were  in 

place  to  prevent  a  soldier  from  putting  a  file  on  a  CD, 
putting  a  CD  into  the  computer,    creating  a  shortcut  on 
the  desktop  and  then  running  the  file? 

A  Still  no  limitations . 

Q  Were  soldiers  authorized? 

THE  COURT:      I'm  sorry? 
THE  WITNESS:      Still  no  physical 

limitations . 

BY  CAPTAIN  WHYTE: 

Q  Were  soldiers  authorized  to  put  an 

unauthorized  executable  file  on  a  CD  or  to  put  the  CD 
in  the  D6A  machine  to  create  the  shortcut  and  run  the 
unauthorized  executable  file  from  the  shortcut? 

A  No,    they  were  not  authorized  to  do  that. 

Q  Would  you  have  authorized  someone  to 

introduce  anything  from  a  CD  on  to  the  D6A  machine  that 
was  unauthorized? 
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A  No. 

Q  What  about  using  a  CD  for  an  authorized 

executable  file,   was  that  something  like  mlRC  Chat,  for 
instance,   would  that  have  been  prohibited? 

A  I  don ' t  know  if  it  would  be  prohibited,  but 

it  would  have  been  unnecessary  because  if  it  were 
authorized  and  they  needed  it  I  would  have  loaded  it. 

Q  So  it  wasn ' t  common  for  soldiers  to  use  a 

CD  to  load  an  executable  file? 

A  Correct . 

Q  Because  that  would  already  have  been  on  a 

computer? 

MR .   COOMBS :      Leading . 

THE  COURT:      I  think  he  just  paraphrased 
what  the  witness  said. 

CAPTAIN  WHYTE :     No  more  questions . 
THE  COURT:  Cross? 
MR.   COOMBS:     Yes,    Your  Honor. 
CROSS  EXAMINATION  BY  MR.  COOMBS: 
BY  MR.  COOMBS: 
Q  Mr.   Millman,    did  you  know  whether  or  not 
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WGet  was  part  of  the  baseline  package  for  D6A 
computers? 

A  I  don't. 

Q  At  the  time  of  the  deployment  did  you  know 

whether  WGet  was  part  of  the  baseline  package? 

A  If  it  were  a  part  of  baseline  package  then 

four  years  ago  I  probably  would  have  known,   but  I  don't 
recall  that . 

Q  Do  you  recall  testifying  that  you  didn't 

know  whether  it  was  part  of  the  baseline  package? 

A  Correct . 

Q  And  in  fact  at  article  32  you  testified 

that  you  tried  to  determine  whether  WGet  was  part  of 
the  baseline  package  by  calling  the  company  that  you 
worked  for? 

A  Yes . 

CAPTAIN  WHYTE:      Just  beyond  the  scope  of 

redirect . 

MR.   COOMBS:      They  called  this  man  to 
testify  about  executable  files  and  WGet  is  an 
executable . 
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THE  COURT:      Go  ahead. 
BY  MR.  COOMBS: 
Q  Do  you  recall  after  the  32  testifying  that 

you  called  the  company  to  try  to  determine  whether  or 
not  WGet  was  part  of  the  baseline  package? 
A  Yes . 

Q  And  they  told  you  basically  they  wouldn't 

give  you  that  information? 
A  Correct . 

Q  Now,   with  regards  to  installing  software. 

If  you  wanted  to  install  a  program  on  the  D6A  machine, 
you  had  to  have  admin  privileges,  correct? 

A  For  programs  like  mIRC  Chat,   no.  For 

programs  like    (INAUDIBLE)    that  made  changes  to  system 
operating  system  files  then  you  would  not    (INAUDIBLE) . 

Q  So  your  testimony  is  that  you  could  add 

mIRC  Chat  as  a  program  to  the  entire  computer  without 
admin  privileges . 

A  I  think  we've  already  established  mIRC  Chat 

was  one  of  those  type  of  executable  files  that  could 
run  by  itself. 
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Q  But  my  question  is :      If  you  wanted  to  add  a 

program  to  the  entire  computer  you  needed  to  have  admin 
privileges,  correct? 

A  I  guess  the  problem  I  have  with  that 

question  is  you  say,   to  the  entire  computer.      It  is 
either  written  on  the  computer  or  it  isn't    (INAUDIBLE) . 

Q  If  you  had  a  program  and  wanted  every  user 

to  log  on  to  that  computer  to  have  use  of  it  you  had  to 
have  admin  privileges  to  put  it  on  the  computer  in  that 
matter? 

A  I  believe  so,  yes. 

Q  And  that  would  be  correct,   you  would  be  the 

one  that  as  admin  privileges? 
A  Correct . 

Q  And  you  talk  about  mIRC  Chat  you  said 

admonishing  what  you  wouldn ' t  need  to  use  an  executable 
file  because  you're  going  to  add  it  to  the  computer, 
right? 

A  It  wouldn't  be  necessarily  on  a  regular 

basis  because  if  it  was  something  that  the  unit  needed 
to  use  a  regular  basis  it  would  have  been  identified, 
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and  I  would  install  it .  The  only  exception  to  that 
policy  is  if  —  I  had  several  camps  to  take  care  of 
between    (INAUDIBLE) . 

So  if  I  was  on  the  other  side  of  the 
country  and  someone  for  some  reason  mIRC  Chat  died  and 
needed  to  be  reinstalled  I  would  probably  authorized 
them  to  reinstall  fro  it  their  shared  drive  without  me 
being  there . 

Q  When  you  install  stuff  you  install  it  to 

the  program  where  any  user  can  log  on  that  to  computer, 
it  was  one  of  the  programs  they  could  use? 

A  Correct . 

Q  You  didn't  install  stuff  as  executable 

files  on  the  computer? 
A  Correct . 

Q  When  you  installed  mIRC  Chat  installed,  a 

version  of  mIRC  Chat  that  was  approved? 
A  Correct . 

Q  Because  not  every  version  was  approved? 

A  I  don ' t  think  that  —  I  don ' t  know  what 

version  was  or  was  not  authorized. 
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Q  But  do  you  know  that  software  that  is 

approved  is  approved  for  a  particular  version  because 
we  want  to  make  sure  it  plays  nice  with  everything  else 
on  the  did  D6A? 

A  Correct . 

Q  So  in  mlRC  Chat  had  version  11  that  was 

approved  and  two  months  later  version  12  come  out . 
Version  12  is  not  authorized  on  the  D6A  computer, 
right? 

A  In  theory  it  would  have  been  until  it  had 

already  been  vetted  by  the  folks  at    (INAUDIBLE)  and 
giving  a  verbal  okay. 

Q  The  answer  would  be  no? 

A  Correct . 

Q  When  your  relying  on  somebody  adding  mlRC 

Chat  as  a  desktop  executable,   when  the  computer  already 
has  it,   what  does  that  tell  you? 

A  I'm  not  sure  I  follow. 

Q  Well,   does  it  tell  you  they're  probably 

adding  a  newer  version  of  mlRC  Chat? 

A  I  don ' t  think  they  would  have  added  another 
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version  of  mlRC  Chat  if  they  already  had  a  version  on 
there  to  use. 

Q  That's  why  I  asked  the  question.      If  they 

already  had  a  mlRC  Chat  on  there  to  use  and  now  they ' re 
adding  something  as  an  executable  file  as  mlRC  Chat, 
would  that  tell  you  that  might  be  adding  a  newer 
version  of  it? 

A  I  suppose  is  not  outside  of  the  realm  of 

possibly,   but  this  is  a  leading  what  if. 

Q  That's  exactly  what  it  is? 

A  Because  I  don ' t  know  that  ever  happened  so 

I  can't  testify  to  that. 

Q  What  I'm  asking  you  is  your  expertise  in 

computers .      If  somebody  has  a  particular  version  of  a 
program  on  their  computer  and  then  they  add  another 
version  as  a  desktop  executable  that  would  be  an 
instance  where  it  might  be  a  newer  version? 

A  Or  it  could  have  been  an  older  version .  In 

some  cases  some  of  the  anti— virus  software  didn't  work 
nice  with  newer  versions  versus  older  versions .  It 
could  have  been  a  older  version. 
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Q  Let ' s  deal  with  your  experience .     You  said 

in  your  experience  you  were  aware  of  certain  officers 
who  always  want  to  have  the  latest  version? 

A  Not  always,   no.      There  was  a  few  in  the 

beginning,   but  there  wasn't  a  frequent  occurrence,  no. 

Q  Well,   then  the  few  in  the  beginning  there 

are  instances  where  somebody  wanted  a  newer  version  of 
a  program,  right? 

A  I  don ' t  know  it  was  a  newer  version  of  a 

program,   but  it  was  a  program  that  was  not  already  on 
the  baseline  from  D6A. 

Q  And  they  wanted  to  add  certain  things  and 

that's  when  you  would  say,   no,   you  can't  do  that? 

A  Correct . 

Q  And  one  of  those  I  believe  involved  a 

soldier  that  —  well,   actually  before  I  get  there  with 
regards  to  executable  files  on  the  desktop,  the 
government  talked  to  another  witness  about  a  meeting 
that  you  had  where  you  called  everyone  in  and  you  told 
them  what  they  could  and  could  not  do  in  January 
February  time  frame.     Do  you  recall  that? 
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A  I  don't  recall  a  specifically  meeting  in 

January,    a  specific  time  frame,   but  I  know  during  the 
repcoa,   the  changeover  from  one  to  the  other  when  the 
new  unit  came  in  I  made  myself  available  to  both  shifts 
and  they  had  shift  change .      So  it  was  the  prior  unit 
incoming  unit  both  day  and  night  shift . 

So  there  were  literally  75  to  a  hundred 
people  in  the  room  where  we  went  over  this  D6A  system, 
this  is  your  D6A  support  guy.      They  pointed  to  me.  Any 
questions  you  go  to  him.     You  can  and  can't  do  this  so 
and  so  forth . 

Q  When  you  say  repcoa  rep  co-that  when  you 

recall  doing  this? 

A  I  also  did  it  when  I  —  the  new  unit  comes 

in  the    (INAUDIBLE)    goes  to  the  men  which  I  went  put  the 
unit  on  the  machine .      I  talked  with  the  users  at  that 
station  and  let  them  know  the  same  thing. 

Q  I'm  just  talking  about  a  meeting  where  you 

would  have  had  both  the  day  and  night  shift,   you  know, 
the  75  or  so  people  you  just  testified  about,   one  area 
you  say  what  you  can  and  can't  do? 
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A  Correct . 

Q  When  do  you  recall  doing  that? 

A  It  was  shortly  after  the  unit  got  there. 

Q  When  was  that? 

A  I  think  it  was  like  October  November  time 

frame.      I  don't  remember  when  they  actually  got  there. 

Q  And  so  when  you  recall  doing  that,  what 

precipitated  you  to  do  that? 

A  Commons ens e .      I  mean,    they  needed  to  know 

what  was  there  and  what  they  were  authorized  to  do  and 
not  to  do . 

Q  Now,   with  regards  to  seeing  you  said  —  you 

testified  earlier  that  you  saw  games  and  music  and 
stuff  on  the  D6A  computer,  right? 

A  I  saw  music  and  I  had  seen  games  on  the  D6A 

laptops .      I  know  there  were  games  on  shared  drives  of 
places,   but  I  never  saw  games  on  the  D6A  laptop. 

Q  We'll  stick  can  with  what  you  remember 

music? 

A  Yes . 

Q  And  my  understanding  is  music  then  in  this 
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big  meeting  you  wouldn't  allow  music  on  the  D6A 
machine,  right? 

A  I  didn't  like  it,   but  I  had  no  authority  to 

tell  them  to  take  it  off.      It  was  —  the  computers 
belong  to  the  unit  specifically  as  far  as  ownership. 
What  they  wanted  to  use  the  computer  of  was  outside  of 
my  authority .      I  worked  for  the  unit .      I  could  tell 
them  what  the  project  authorized  and  didn't  authorize 
and  if  they  violated  those  terms  in  theory  they  would 
violate  their  warrantee  and  support  for  this  project. 

Q  So  if  I  understand  you  correctly  then  if 

you  saw  music  you  could  say  I  don't  know  like  that,  but 
I  can't  force  you  to  take  it  off? 

A  Correct . 

Q  If  you  saw  executable  files  that  they're 

not  part  of  the  baseline  package,   was  that  true  for 
that  as  well  where  you  could  say  I  don't  like  it,   but  I 
can't  make  take  it  off? 

A  The  determining  factor  was  that  if  the 

programs  loaded  on  to  laptop  that  were  not  part  of  the 
D6A  baseline,    if  they  were  unknown  to  work  or  not  we 
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could  try  it  out .      If  it  interfered  with  the  system 
software  say  RJIS  programs    (INAUDIBLE)    if  it  damaged 
those  programs  ability  to  operate  then  they  had  to  come 
out.      If  it  didn't,   we  would  allow.      If  it  was  very 
very  rare  that  that  came  up . 

So  the  end  result  was  if  they  had  something 
that  was  part  of  the  baseline  but  it  was  allowed 
authorized,    it  was  okay.      I  mean,   whether  I  liked  it  or 
not . 

Q  I  just  want  to  make  sure  I  understand  it . 

If  I'm  an  intel  analyst  and  I'm  working  in  the  shop  and 
you  come  up  to  me  and  I  say,    I've  got  this  executable 
file  that  I  like,   it's  not  part  of  the  baseline 
package,    I  like  it.      It  helps  me  do  my  job  or,  you 
know,    I  think  it's  a  good  executable,    I  put  it  on  my 
desktop .     You  see  me  do  that ,   you ' re  not  happy  with 
that  but  I  say  it  plays  nice  with  all  of  the  other 
programs,    can  you  make  me  take  it  off? 

A  Yes .      In  that  case  yes  because  there  was  no 

prior  coordination  to  see  if  it  was  allowed  to  be  put 
on.      If  that  happened  my  direction  was  to  immediately 
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take  the  machine .      If  I  were  would  notice  that 
happening  my  initial  is  to  take  the  machine. 

Q  Music,   why  was  it  the  same  reaction? 

A  Because  that ' s  not  a  program  that  make 

changes  to  system  files  and  so  on. 

Q  So  in  your  mind  there  was  a  difference 

between  music,   how  about  games? 

A  Games  would  have  been  treated  the  same  way 

as  far  as  reusing  the  machine . 

Q  In  you  saw  games  on  a  D6A  machine  and  you 

tell  them  to  take  it  off  and  if  they  didn't  you  would 
say  I  want  the  machine? 

A  I  would  notify  the  NCO  in  charge  of  that 

person.  If  it  wasn't  an  NCO  knock  then  would  have  the 
next  supervisor  was  and  contact  and  let  (INAUDIBLE)  it 
would  be  taken  almost  immediately . 

Q  Did  you  ever  do  that? 

A  I  don't  recall  any  instance  of  that  needing 

to  be  done . 

Q  So  you  don ' t  recall  any  instances  where  you 

saw  somebody  with  games  on  their  D6A  machine? 
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A  Correct . 

Q  Were  you  looking  for  that? 

A  I  wasn ' t  going  to  each  person  every  day  to 

see  if  they  had  games  on  their  machine,   but  when  I  went 
to  their  machines  to  do  updates  if  he  had  problems  I 
would  see  what  that  had  on  the  machine  because  I  would 
need  to  check  out  their  portfolio .      If  the  machine  had 
crashed  would  you  look  on  their  portfolio  and  see  what 
data  they  and  ask  them  what  they  wanted  me  to  save.  If 
they  had  something  like  games  I  would  have  seen  it . 

Q  And  you  don't  recall  ever  seeing  that? 

A  No. 

Q  Would  it  surprise  you  that  games  were  on 

analysts  computers? 

A  No,    knowing  human  nature  it  wouldn't 

surprise  me  at  all . 

Q  It  wouldn't  surprise  you,   but  you  didn't 

see  it  at  all  the  time  you  were  there? 

A  I  didn't  see  it. 

Q  You  did  report  an  incident  that  involved  XP 

Lite,  L-I-T-E? 
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A  That  name  sounds  familiar.      I'm  not  sure  I 

mentioned  a  program  to  prosecuting  attorneys.      I  don't 
know  what  the  name  was,   but  there  was  some  program  they 
liked  that  would  condense  PowerPoint  programs . 
PowerPoint    (INAUDIBLE)      But  I  don't  remember  the  name 
specifically . 

Q  Do  you  remember  ever  going  essentially  to 

the  S6  because  they  added  that  program  to  the  D6A 
machine  over  your  authorization? 

A  There  was  a  program  I  think  I  mentioned 

this  that  they  loaded  to  install .     That  may  have  been 
that  software,   but  I  don't  recall  the  name  of  the 
software . 

Q  And  when  you  took  that  to  the  S6  what 

happened  after  you  say  hey  you  cracked  my  password  you 
added  this  program,   what  happened  after  that? 

A  I  had  to  take  the  machine  because  one  of 

things  they  took  was  to  delete  administrator  account 
from  the  machine  which  is  a  required  account  for  me  to 
do  my  job.     So  I  had  to  reimagine  the  machine, 
reinstalled  the  account  and  put  those  back  the  way  they 
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were  before  S6  got  a  hold  of  it. 

Q  Now,   with  regards  to  executable  programs 

they  can  be  from  a  CD;    is  that  right? 

A  Yes . 

Q  And  they  can  be  run  if  you  take  the 

contends  of  a  CD  and  you  put  on  the  desktop  then  you 
can  run  an  executable  from  the  desktop;    is  that 
correct? 

A  Yes,  sir. 

Q  And  if  you  want  to  keep  it  on  the  CD  and 

you  want  to  create  a  shortcut  you  can  create  a  shortcut 
on  your  desktop  to  run  it  from  the  CD? 

A  Yes,  sir. 

Q  Those  are  the  three  ways  that  essentially 

an  executable  program  can  be  run? 
A  Correct . 

Q  With  regards  to  executables,   when  you  had 

that  meeting  of,   you  know,   what  you  could  and  could  not 
do,   do  you  recall  referencing  executable  files? 

A  No,    I  don't. 

MR .   COOMBS :      Thank  you . 
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THE  COURT:     Does  that  mean  you  don't  recall 
or  you  didn ' t  reference  them? 

THE  WITNESS:      I  don't  recall  referencing 
them  anything  further  from  the  government . 

CAPTAIN  WHYTE:     Nothing  further,  ma'am. 

THE  COURT :      Could  games  be  run  from  CDs . 

THE  WITNESS:      I  suppose  they  could,  ma'am. 

THE  COURT:      If  they  were  would  you  see  them 
when  you  looked  at  the  machine . 

THE  WITNESS :     No  if  they  were  contained  on 
the  CD  they  put  a  music  CD  in  their  then  came  to  the 
machine  I  couldn't  tell  you  they  played  it. 

THE  COURT:      If  there  were  shortcuts  for  CD 
programs  or  games  on  the  a  machine  when  you  were  on  the 
machine  to  fix  problems  would  you  see  the  shortcut? 

THE  WITNESS :      I  would  see  a  shortcut .  If 
they  needed  work  and  it  was  their  games  all  I  would  see 
is  a  shortcut  that  said  work. 

THE  COURT:     Are  music  CDs  executable  files? 

THE  WITNESS:      I  don't  really  know  the 
answer  to  that,   ma'am.     A  general  sense  I  would  say  not 
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really  no . 

THE  COURT:     How  about  movies? 

THE  WITNESS:      I  would  say,    yes,  probably. 

THE  COURT:     Any  follow-up  based  on  that? 

CAPTAIN  WHYTE:     One  second. 

THE  COURT :     While  the  government  is 
conversing  I  have  one  final  question. 

Movies  are  executable  files .     Were  music 
or  executable  file  files  do  they  require  a  media 
player  to  play  them? 

THE  WITNESS:     Movies  definitely  would,  I 
guess,   depending  on  the  music,   yes,   they  would  both 
require  a  media  player . 

THE  COURT:     Were  media  players  authorized 
for  the  D6A  computers? 

THE  WITNESS :      I  know  there  was  a  version  of 
media  player  while  I  was  at  Camp  Solara .     Normally  D6A 
laptops  use  BLC .      I  don't  remember  FOB  Hammer  D6A  based 
on  it  had  Windows  media  players  other  the  VLC  or  both 
or  neither.      I'm  99  percent  sure  there  was  a  media 
player  because  I  know  that  the  had  analysts  had  to  have 
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the  ability  to  analyze  and  review  videos  and  audio 
clips .     So  I  don ' t  remember  which  media  player  they  but 
I  know  they  had  something . 

THE  COURT:      If  the  D6A  computer  had  a  media 
player  that  could  play  music  and  movies  why  would  they 
prohibit  it  on  the  D6A  computer? 

THE  WITNESS:      I'm  not  sure. 

THE  COURT:     Maybe  I  misunderstand.  I 
thought  that  the  testimony  earlier  was  that  you 
couldn't  have  music  or  games  —  games,    I  don't  remember 
a  media  player. 

THE  WITNESS:     No,    I  don't  think  so.  I 
guess  it's  kind  of  a  gray  area,   at  least  to  me.  I 
guess  I'm  not  as  in  tune  as  some  of  the  other  co— called 
experts,   but  for  music  and  movies  I  guess  they  are  an 
executable  for  them  to  run,   but  I  think  what  we  are 
referring  to  executable  here,   we're  talking  about  a 
self —contained  program  that  performs  some  sort  of 
either  data  manipulation  or  editing  of  files . 

So  since  a  music  file  doesn't  perform 
data  manipulation  or  edit  a  file  to  view  it  as  a 
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movie,    I  don't  think  it's  classified  as  (INAUDIBLE) 
like  mlRC  Chat .      That  will  support  say  chat  history 
so  you  can  go  back  and  look  at  stuff.      In  that 
instance  I  think  mlRC  Chat  is  an  executable,   but  I 
wouldn't  classify  movies  or  music  of  that  type  of 
executable  if  that  makes  sense . 

THE  COURT:     Any  follow-up  based  on  that? 

CAPTAIN  WHYTE:     No,  ma'am. 

THE  COURT :      I'll  ask  you  one  more .  What 
was  the  purpose  of  not  allowing  music  and  movies? 

THE  WITNESS:     Once  again,   the  music  and 
movies  stuff  we  couldn't  disallow.     That  would  void  the 
service  contract  because  once  again  it  doesn ' t  create 
any  database  manipulation  or  editing  of  files  so  it 
wouldn't  interfere  with  D6A  other  programs,   but  other 
programs  that  were  on  so-called  executable  that  would 
make  file  changes,    some  system  file  changes,   those  type 
of  executables  had  to  be  vetted  through  Camp 
(INAUDIBLE)    for  authorization  to  put  on  the  machine 
because  if  they  interfered  with  those  mission  essential 
programs  they  couldn ' t  be  on  the  machine . 
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THE  COURT :      Could  games  interfere  with 
those  programs? 

THE  WITNESS :      I  think  games  would  because 
games  store  information  and  use  system  files . 

THE  COURT :     My  understanding  of  your 
testimony  to  be  that  music  and  movies  were  not  in 
violation  of  D6A  computer  rules  but  games  were? 

THE  WITNESS :      I  believe  that  to  be  correct . 
Again,    it's  wasn't  like  it  wasn't  preferred  it  wasn't 
condoned,   but  when  it  got  right  to  the  brass  tacks  the 
company  I  work  agree  to .     We  work  for  the  military .  It 
was  up  to  the  command  to  decide  what  they  would  or 
would  not  allow  on  a  machine  as  long  as  it  didn ' t 
interfere  with  the  mission. 

So  while  we  may  not  have  liked  whether 
they  played  music  or  movie  we  couldn't  prohibit  them 
from  playing  movies  or  music. 

THE  COURT :     Any  follow-up  based  on  that . 

CAPTAIN  WHYTE:      Just  a  few,  ma'am. 
REDIRECT  EXAMINATION  BY  CAPTAIN  WHYTE: 

BY  CAPTAIN  WHYTE: 
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Q  Mr.   Millman,   was  the  T— Drive  unique  to  the 

D6A  machines? 

A  No .      The  T— drive  was  the  unit ' s  shared 

drive . 

Q  So  people  that  were  not  on  D6A  machine 

could  put  information  on  the  T— drive? 
A  Correct . 

Q  Did  a  soldier  ever  ask  you  to  put  on  WGet? 

A  I  don't  recall  any  soldier  asking  me  that. 

Q  Have  you  heard  of  WGet? 

A  I  don't  recall  hearing  that  until  this  came 

about . 

CAPTAIN  WHYTE:     Nothing  further,  Your 

Honor . 

THE  COURT:  Defense? 

MR.   COOMBS:     Nothing,  ma'am. 

THE  COURT :      Temporary  or  permanent . 

CAPTAIN  WHYTE:  Temporary. 

THE  COURT:     Mr.   Millman,    you  are 
temporarily  excused.     Please  don't  discuss  your 
testimony  or  knowledge  of  the  case  with  anyone  other 
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than  counsel  or  the  accused  while  the  trial  is  going 
on . 

THE  WITNESS:     Yes,  ma'am. 

MAJOR  FEIN:     United  States  calls  Special 
Agent  Shaver . 

MR.   TOOMAN:     Before  the  witness  comes  out, 
the  defense  would  like  to  address  an  issue  with  the 
Court . 

THE  COURT:      Go  ahead. 

MR.   TOOMAN:     Your  Honor,    one  of  the 
rationales  provided  by  the  government,    I'll  just  read 
it  verbatim  so  I  don't  miss  represent  anything  here. 
United  States  will  recall  Special  Agent  Shaver  to 
discuss  how  WGet  is  run  from  the  accused  profile  on  his 
SIPRnet  computer's  counter  system.      The  testimony  of 
CW2  Esherman  that  an  executable  file  can  be  run  off  of 
a  disk. 

It ' s  defenses  position  that  Chief 
Ehresman  never  testified  about  WGet  or  how  it  was 
run  by  the  excused.     We  believe  the  testimony  was 
questioned  by  Major  Fein  do  you  know  what  WGet  is, 
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no,    you  don't  know  what  WGet  is?     I  don't.      So  you 
don't  know  he,    assuming  my  client  here,   was  good  or 
bad  at  using  WGet?     No,  sir. 

Was  WGet,    to  the  best  of  your  memory, 
one  of  those  D6A  tools  that  the  Army  provided  to 
intel?     I  don't  know  what  WGet  it  is. 

It's  defense's  position  that  he  never 
testified  about  WGet.     To  the  extent  that  Chief 
Ehresman  talked  about  executable  files  and  how 
they're  run.     He's  been  consistent  on  that.     He  said 
there  were  a  couple  of  ways  you  could  to  do  it .  You 
can  run  it  off  of  disk.     You  can  take  it  from  a  disk 
and  put  on  it  to  your  portfolio . 

It  defense's  position  Special  Agent 
Shaver  will  say  to  you  the  same  thing  as  Mr. 
Millman.     When  you  have  a  executable  file  you  can 
run  it  from  the  CD,    you  can  take  it  off  of  a  CD  and 
put  it  onto  your  desktop  or  your  user  profile  and 
those  are  the  only  ways  you  can  run  it . 

A  third  was  referenced  where  you  create 
a  shortcut .      That  essentially  still  running  it  off 
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the  CD.      That's  what  Special  Agent  Shaver  will  say 
as  well.     As  far  as  the  government  wanting  to  talk 
about  WGet,   we  don't  feel  it's  proper  rebuttal, 
Chief  Ehresman  didn ' t  talk  about  it .     He  said  I 
don ' t  know  what  it  is . 

Special  Agent  Shaver  isn ' t  going  to  to 
rebut  anything  Chief  Ehresman  said  because  he ' 11  say 
they  were  —  echo  what  Chief  Ehresman  said  and  what 
Mr.   Millman  said  here  today. 

MAJOR  FEIN:     May  I  have  a  moment,  Your 

Honor? 

CAPTAIN  OVERGAARD :     Ma ' am,    the  government ' s 
filing  and  litigated  yesterday,   the  United  States  is 
recalling  Special  Agent  Shaver    (INAUDIBLE)   was  run  from 
the  accused  profile  on  a  SIPRnet  computer.  The 
testimony  of  Chief  Ehresman  was  executable  files  in 
general  that  could  be  run  off  the  desk.     So  there's 
been  some  confusion  about  how. 

THE  COURT:     Now,   well  you're  recalling 
Special  Agent  Shaver  to  talk  about  where  WGet  was 
forensically  on  PFC  Manning's  computer;    is  that 
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correct? 


CAPTAIN  OVERGAARD: 


How  it  was  run 


forensically  on  his  computer. 


THE  COURT: 


Chief  Ehresman  testified  about 


where . 


CAPTAIN  OVERGAARD: 


He  testified  about  how 


executable  files  could  be  run  off  of  a  disk.     So  the 
government  believes  that  on  the  D6A  computer  and  a 
Chief  Ehresman  and  Mr.   Millman  are  not  computer 
experts.     They  haven't  been  called  as  computer  experts. 
The  government  believes  that  someone  is  necessary  to 
come  in  and  explain  to  the  court  how  this  program  was 
run  and  how  it  was  run  in  this  case  and  how  executables 
files  are  run  because  Chief  Ehresman  said  he  wasn't 
sure  it  was  executable .     Mr .   Millman  said  I  think  it 
was ,   but  he  wasn ' t  sure  either  and  he ' s  not  a  computer 
expert . 


allow  it  because  I'm  a  little  bit  confused  as  the  fact 
finder  and  I  can  also  ask  for  witness  here  RCM913CF. 
So  I'm  going  to  allow  Special  Agent  Shaver  to  testify. 


THE  COURT:      Captain  Tooman,    I'm  going  to 
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MR.   TOOMAN :      I  guess  we  would  just  say  that 
certainly  Agent  Shaver  could  rebut  the  testimony  of 
Chief  Ehresman  as  about  how  executable  files  run,  but 
there ' s  nothing  to  rebut  with  respect  to  how  WGet  was 
run  by  PFC  Manning.      The  defense  has  put  on  no  evidence 
about  that . 

THE  COURT:      I'm  going  to  allow  it  any  way 
because  I'm  confused  on  that  issue  and  I  think  this 
witness  can  provide  some  clarity. 

Go  ahead . 

MAJOR  FEIN:     United  States  recalls  special 
Agent  David  Shaver. 

DIRECT  EXAMINATION  BY  MAJOR  FEIN: 
BY  MAJOR  FEIN: 
Q  Please  take  a  seat,   Special  Agent  Shaver, 

as  I  remind  you  you're  still  under  oath. 
A  Yes,  sir. 

Q  I'm  going  to  grab  some  exhibits  before  we 

proceed . 

THE  COURT:      They've  all  been  marked. 
MAJOR  FEIN:      They  have,    Your  Honor. 
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MR.   TOOMAN:     We  object.     We  believe  that 
the  government  is  going  use  some  sort  of  PowerPoint  and 
we  have  not  been  provided  that  in  advance . 

THE  COURT :     Has  it  been  seen  it . 

MAJOR  FEIN:     No,   ma'am.      It's  a 
demonstrative  exhibit  that  we're  going  to  lay  a 
foundation  like  the  defense  did  with  Mr.   Hall  that  he 
created  himself  and  he ' s  going  to  go  through  it  and  we 
can  take  a  recess  and  give  them  a  copy. 

MR.   TOOMAN:      If  I  could  just  take  a  quick 
look  at  it.     Ma'am,    if  we  can  take  a  recess  and  make  a 
copy  of  this? 

THE  COURT :     How  much  time  would  you 

like? 

MR.   TOOMAN:      10  minutes. 

THE  COURT:     Any  objection  to  that? 

MAJOR  FEIN:     No,  ma'am. 

(Hearing  recessed  at  3:15  p.m.) 

(Hearing  resumed  at  3:40  p.m.) 
THE  COURT:      I   just  held  a  RCM802 
certification  with  counsel  prior  to  coming  in  and 
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Captain  Tooman  advised  me  that  the  defense  had  several 
objections  to  the  upcoming  testimony. 

Did  we  need  to  excuse  the  witness  while 
we  present  them  for  the  record? 

MR.   TOOMAN:      I  don't  think  so,    Your  Honor. 

THE  COURT:     Please  go  ahead. 

MR.   TOOMAN:     Your  Honor,   Agent  Shaver  and 
how  WGet  specifically  is  run.     We  understand  the  Court 
seeks  clarification  as  to  how  WGet  actually  got  on  PFC 
Manning's  computer,   but  we  don't  believe  that  would  be 
proper  to  get  into  how  WGet  runs  once  it ' s  on  PFC 
Manning  computer  because  we  didn't  elicit  any  testimony 
to  that  during  our  case  in  chief. 

We  would  also  object  to  the  forth  slide 
which  is  a  command  prompts  which  includes  PFC 
Manning.     Our  objection  there  is  this  isn't  a 
command  prompt  that  was  found  forensically  so  it 
would  be  confusion  as  to  whether  or  not  this  is 
actual  evidence  of  what  PFC  Manning  did  and  it ' s  not 
evidence  to  what  PFC  Manning  may  have  done .      So  we 
would  just  ask  that  it  his  not  be  used  with  respect 
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to  this  evidence . 

THE  COURT :      Government  ? 

MAJOR  FEIN:     Ma'am,    for  the  first  point 
the,    United  States  originally  based  on  Chief  Ehresman 
was  there  was  a  interference  that  program  WGet  or 
another  could  be  run  on  a  CD  and  to  truly  understand 
whether  that  is  what  happened  in  this  case  under  these 
circumstances  where  the  program  was  run,    it's  best  for 
the  Court  to  try  to  understand  how  WGet  works  for 
Special  Agent  Shaver  I  guess  opinion  really  on  whether 
that  is  what  occurred  or  not . 

The  second  point  is  the  forth  slide  the 
United  States  discuss  not  —  this  whole  slide  shows 
demonstrative  overall,   especially  Agent  Shaver 
created  every  piece  of  this  slide  show  including 
that  command  prompt  and  in  the  actual  direct  the 
United  States  intends  to  elicit  that  he  is  not 
saying  this  is  actually  what  PFC  Manning  had  on  his 
computer,   but  he  replicated  it  in  order  to  aid  him 
in  his  testimony. 

THE  COURT :     Yes . 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


CAPTAIN  TOOMAN:     Your  Honor,   to  clarify 
Chief  Ehresman,   he  did  testify  that  an  executable 
could  be  run  a  CD,   but  he  also  testified  that  an 
executable  can  be  run  by  taking  that  off  file,  the 
CD,    and  place  it  on  the  user  portfolio  and  running 
from  it  there . 

So  we  don ' t  believe  we  put  forward  any 
evidence  that  PFC  Manning  did  it  one  way  or  the 
other .     These  are  the  ways  it  happened  and  we 
believe  that  Agent  Shaver  would  echo  that  at  the 
ways  that  it  happened  the  same  in  rebut . 

THE  COURT:     All  right.     Well,    I've  already 
ruled  on  this  earlier  and  I'm  going  adhere  to  my 
original  ruling.      I  am  going  to  allow  this  in  and  I 
certainly  understand  this  is  a  demonstrative  exhibit 
and  I  certainty  won ' t  use  for  it  anything  else . 

Go  ahead . 

MAJOR  FEIN:     Yes,  ma'am. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    again,   you're  under 

oath . 
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A  Yes . 

Q  In  preparation  for  your  testimony  about 

WGet  and  how  it  works  and  where  it  was  found  on  PFC 
Manning's  computer  did  you  prepare  a  demonstrative 
exhibit  during  your  testimony? 

A  Yes. 

MAJOR  FEIN:  Your  Honor,  I'm  handing 
Special  Agent  shaver  Prosecution  Exhibit  187  for 
identification . 

BY  MAJOR  FEIN: 

Q  Could  you  look  at  this,  please? 

A  (Witness  reviewing  document . ) 

Q  Do  you  recognize  prosecution  187  for 

identification? 

A  Yes,  sir. 

Q  How  do  you  recognize  it? 

A  It  is  a  PowerPoint  presentation  I  created. 

Q  When  did  you  create  this? 

A  I  completed  it  this  morning. 

Q  And  did  you  create  every  aspect  of  this 

PowerPoint  presentation? 
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A  I  did. 

Q  I'm  retrieving  prosecution  Exhibit  187  for 

identification,    Your  Honor. 

How  many  slides  was  does  this  exhibit 
contain,    Special  Agent  Shaver? 

A  Four . 

Q  Special  Agent  Shaver  what  is  WGet? 

A  That  is  a  command  line  tool  to  download 

files  from  a  web  server. 

Q  What  is  a  web  server? 

A  It  is  a  computer  running  special  software 

which  allows  it  to  host  web  pages . 
Q  What  is  a  web  page? 

A  That  is  a  graphical  interface  to  show  to 

the  use . 

THE  COURT :  I  know  going  to  ask  you  to  ask 
all  three  of  those  questions  again.  This  is  so  fast  I 
can ' t  even  understand  it .     So  go  ahead . 

MAJOR  FEIN:     Yes,  ma'am. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver  what  was  WGet? 
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A  That  is  a  command  line  tool  that  you 

download  from  a  web  server. 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 

Q  What  is  I ' 11  ask  you  in  a  moment  about  what 

is  a  web  server? 

A  That  is   just  a  computer  with  a  piece  of 

software  on  it  that  allows  it  to  host  web  pages . 

Q  And  what  is  a  web  page? 

A  That  is   just  a  file  that  presents 

information  to  a  user  to  be  viewed  over  the  Internet . 

Q  When  does  the  term  file  type,   what  does 

that  describe  on  a  computer? 

A  Just  what  kind  of  file  it  is . 

Q  And  what  is  the  common  file  type  for  a  web 

page? 

A  An  HTML. 

Q  What  does  HTML? 

A  Hypertext  markup  language . 

Q  Now,   you've  explained  what  a  web  server, 

web  pages,   what  is  a  website? 
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A  A  website  is  hosted  on  a  web  server  and  it 

is  a  collection  of  web  pages . 

Q  And  how  does  a  website  with  web  pages 

relate  to  a  web  server? 

A  A  web  server  hosts  them  and  they  are 

contained  within . 

Q  What  do  you  mean  by  host? 

A  It  presents  it  to  the  users  on  the 

Internet . 

Q  How  does  a  file  type  relate  —  now,   go  to 

basically  installed  programs .     What  is  an  installed 
program? 

A  It  is  a  program  which  has  been  used  as  an 

installer.      It's  a  program  that  places  the  file  into 
the  program  files  folder  also  generally  puts  an 
uninstaller  so  in  case  you  need  to  remove  the  software . 

Q  What  is  a  program? 

A  That  is  a  file  that  interfaces  with  the 

operating  system  to  do  a  task. 

Q  And  how  do  file  types  relate  to  installed 

programs  on  a  computer? 
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A  The  file  types  are  associated  with 

installed  programs.     For  example,   a  document  at    .doc  is 
associated  with  the  Microsoft  product,   Office  Word. 

Q  What  type  of  file  can  you  link  to  do  a  web 

page? 

A  Any  type  of  file. 

Q  What  does  it  mean  to  be  linked  to  a  web 

page? 

A  Within  the  web  page  it ' s  a  redirect  to  a 

file  somewhere  else,   whether  it's  locally  on  the  same 
web  server  or  some  other  part  of  the  Internet . 

Q  And  what  do  you  mean  by  redirect? 

A  It  is  a  URL  location  and  you  would  click  on 

it  and  you  would  then  be  brought  to  the  next  location. 

Q  What  is  a  URL? 

A  Uniform  Resource  Locator . 

Q  What  does  that  provide  a  user  or  a  web 

browser? 

A  It ' s  an  address  on  the  Internet . 

Q  On  the    .22  and   .40  on  the  D6A  SIPRnet 

computers  where  programs  were  installed  to  allow  all 
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users  to  view  the  contents  of  a  web  page. 

A  Internet  explorer . 

MR.   TOOMAN:     Objection.     We  think  is 
outside  the  scope  of  rebuttal.      If  we  want  to  talk 
about  WGet  that's  one  thing,   but  I  think  this  is 
outside  of  what  the  Court  has  said  is  appropriate. 

THE  COURT:     Full  automation  program  how 
programs  get  in  on  computers  and  things  like  that  has 
been  raised  in  this  trial.      So  I'm  going  to  allow  it. 
Go  ahead . 
BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    on  the   .22  and  .40 

SIPRnet  computers  what  programs  were  installed  to  allow 
a  user  to  view  the  contents  of  a  web  page? 

A  Explorer  and  Firef ox . 

Q  What  type  of  programs  are  those? 

A  Those  are  web  browsers . 

Q  What  is  the  purpose  of  a  web  browser? 

A  It ' s  allows  the  user  to  view  web  pages . 

Q  Now,   you  testified  a  moment  ago  about 

linked  files  on  I  web  page.     How  would  a  user  view  a 
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linked  file  on  a  web  page? 

A  You  would  first  open  an  Internet  browser 

navigate  to  the  web  page,    identify  the  link.  They 
would  like  to  go  to  and  move  the  mouse  and  click  on  the 
link . 

Q  What  would  happen  once  you  click  on  that 

link? 

A  It  would  —  the  link  would  open  up .     A  link 

would  open  a  new  website  or  it  would  download  a  file. 

Q  And  when  you  said  download  a  website,  can 

the  link  be  another  web  page? 

A  It  can . 

Q  And  when  you  click  on  the  link  that ' s 

another  web  page,   what  happens  to  that  web  page  you're 
linked  to? 

A  You  now  go  that  web  page . 

Q  What  does  that  mean? 

A  That  web  page  is  presented  to  you  within 

the  web  browser . 

Q  Special  Agent  Shaver,    does  one  of  the 

slides  cited  help  demonstrate  what  you  just  testified 
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about? 

A  Yes . 

Q  Which  slide? 

A  Slide  number  one. 

MAJOR  FEIN:     Your  Honor,   permission  to 
publish  slide  number  one? 

THE  COURT :     Yes . 
BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    using  this  slide 

slide  number  one  could  you  please  explain  to  the  Court 
exactly  how  a  user  would  access  a  file  name  file  name 
one  dot  PDF  on  a  web  server  on  a  web  page? 

A  If  you  direct  your  attention  to  the  lower 

left  that  would  be  the  user ' s  computer .  They  would 
open  a  web  browser .  They  wrote  navigate  to  the  web 
page  at  the  address . 

There  is  example  I  have  given  is 
www.website.sgov.gov.     Government  web  page  would  be 
presented  to  the  user.     They  would  identify  the  link  to 
file  name  one  dot  PDT .      The  user  would  click  on  it 
because  he  would  then  pass  that  command  to  the  web 
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server  to  present  that  to  the  user . 

The  web  server  would  pull  it  from  it 
various  locations  whether  it ' s  locally  or  somewhere 
else  on  the  Internet .      It  would  then  be  presented  to 
the  user  in  the  web  page . 

Q  Special  Agent  Shaver,   what  is  that  dotted 

blue  line  with  file  name  one  dot  PDF  on  this  exhibit? 

A  It  depends .      That  is  for  if  you  click  on  a 

file  and  your  website  does  not  allow  you  to  view  web 
PDT  files  or  allows  you  to  save  that  locally. 

Q  What  do  you  mean  by  save  it  locally? 

A  When  you  click  on  the  link  if  the  web  page 

you're  viewing  does  not  allow  you  to  view  PDF  files  it 
will  say  would  you  like  to  save  this  file  to  your 
machine . 

Q  What  do  you  have  to  do  when  you ' re 

presented  with  that  question? 

A  You  can  either  say  yes  or  no . 

Q  And  with  that  example  the  PDF  is  that  true 

for  all  other  file  types? 

A  It  could  be,  yes. 
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Q  What  about  web  pages? 

A  Web  pages  are  displayed  within  web  browser . 

An  executable  would  be  served. 

Q  So  we'll  get  to  execute  in  a  moment,  but 

for  a  web  page  if  a  user  was  to  navigate  in  your 
example  to  website.sgov.gov  to  that  web  page.     On  that 
I  think  you  have  on  webpageindex . HTML  and  they  were  to 
navigate  there  and  click  on  another  web  page,   what  is 
the  route  that  the  web  page  takes  to  get  to  the  user ' s 
computer? 

A  Through  the  web  browser . 

Q  Is  that  the  same  web  browser  that  you 

initially  were  navigating  on? 

A  Correct . 

Q  Do  you  normally  get  a  prompt  that  says  do 

you  want  to  the  save  or  not? 

A  Not   for  an  HTML. 

Q  And  that  is  a  web  page? 

A  Correct . 

Q  Special  Agent  Shaver,    earlier  you  testified 

that  WGet  was  a  program  that  allows  you  to  copy  files 
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to  a  web  server.     Now  I'd  like  to  ask  you  to  specific 
question  about  WGet . 

I'm  pulling  off  slide  one  of  Prosecution 
Exhibit  187 .     What  does  WGet  allow  users  to  do  on  a  web 
server? 

A  Download  files. 

Q  And  where  does  it  download  to? 

A  To  the  local  machine . 

Q  What  do  you  mean  by,    local  machine? 

A  The  person  using  WGet  would  generally  save 

it  to  their  local  machine . 

Q  When  using  WGet  is  the  user  required  to 

navigate  through  the  original  web  page  that  they  would 
otherwise  have  to  use  when  they  open  up  Internet 
Explorer? 

A  It  depends  on  what  files  you  want  to  copy. 

If  you  want  to  you  can  tell  it  to  go  to  a  web  page 
identify  all  of  the  links  and  copy  all  of  that  down . 
If  you  just  would  like  to  download  one  file  it  would 
not  go  through  that . 

Q  And  if  you  wanted  to  download  a  single  file 
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why  would  it  not  go  through  the  individual  web  page? 

A  It  doesn ' t  need  to .     You  would  provide  a 

direct  URL  to  the  file  in  question. 

Q  And  the  user  running  WGet  to  obtain  a  file 

on  a  web  server  what  happens? 

A  The  file  would  be  downloaded  to  your  local 

machine . 

Q  From  where? 

A  From  the  web  server . 

Q  And  does  that  target  file  then  when  it ' s 

downloading  again  pass  through  that  original  web  page 
containing  the  link  to  the  file? 

A  No,  sir. 

Q  Special  Agent  Shaver,    do  one  of  the  slides 

that  you  created  help  demonstrate  what  you  just 
testified  about? 

A  Yes,  sir. 

Q  Which  slide  that? 

A  Slide  two. 

MAJOR  FEIN:        Your  Honor,   permission  to 
publish  slide  two? 
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THE  COURT:      Go  ahead. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    is  this  slide  two? 

A  Yes,  sir. 

Q  And  could  you  please  explain  to  the  Court 

this  demonstrative  exhibit  on  how  WGet  downloads  this 
file  name  do  the  PDF  from  a  web  server? 

A  Yes,    sir.     Again  in  the  lower  left  is  the 

user.     They  use  WGet.      It  goes  to  the  website  again 
website.sgov.gov.      It  downloads  the  file  name  by  PDT 
and  that  is  then  saved  locally  on  the  machine . 

Q  And  when  a  user  runs  WGet  and  your  example 

used  a  PDF  that  also  what  you  just  describe  the  same 
for  a  web  page? 

A  It  depends  on  how  you  want  to  do  it .  You 

can  say  download  a  web  page  and  it  will .     You  can  also 
tell  it  to  go  through  a  web  page  and  only  pick  out 
certain  files .     WGet  is  a  very  configurable  tool . 

MAJOR  FEIN:      I  will  removal  slide  two,  Your 

Honor . 

BY  MAJOR  FEIN: 
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Q  All  the  next  few  questions  will  be  based  on 

your  knowledge  of  WGet  on  a  computer  regardless  which 
is  authorized  or  not  to  be  installed  or  stored  on 
computers.     Just  about  the  capabilities. 

Technically  speaking  how  does  a  user 
introduce  WGet  onto  there  their  Windows  based  computer? 

A  They  would  go  to  a  web  browser,   navigate  to 

a  web  site  that  has  the  file  WGet,   download  and  save  it 
to  the  desktop . 

Q  So  now  the  same  question  on  a  technical 

basis .     How  does  —  could  one  introduce  WGet  onto  a 
SIPRnet  computer? 

A  User  would  open  a  web  browser,    search  for 

WGet,    download  it  to  on  the  NIPRnet  computer,   put  it  on 
some  kind  of  transport  medium,    a  CD,    for  example,  and 
then  walk  over  to  the  SIPRnet  and  put  the  CD  into  the 
SIPRnet  computer  and  copy  the  file  from  the  CD  on  to 
their  user  portfolio. 

Q  Where  on  a  computer  can  WGet  be  run  from? 

A  Anyplace  the  user  has  access. 

Q  And  what  did  you  mean  by  that? 
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A  User  accounts,    there's  Windows  is 

permissions .  There ' s  certain  places  a  user  cannot 
access.  For  example,  the  Windows  folder  itself  or 
other  profiles  on  the  computer. 

Q  What  do  you  mean  by  profiles? 

A  User  accounts,   other  people  who  have  logged 

onto  that  computer.  It  would  create  a  profile  and  that 
would  be  —  a  normal  user  could  not  access  the  files  in 
those . 

Q  Again  technically  speaking  can  WGet  be  run 

from  a  CD  or  DVD? 

A  It  could. 

Q  Could  it  be  run  from  a  USB  drive? 

A  Yes . 

Q  What  about  an  SD  card? 

A  Yes . 

Q  And  shared  drive? 

A  Yes,  sir. 

Q  And  is  WGet  a  program  that  must  be 

installed? 

A  No. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


71 

Q  Why? 

A  It  is  a  self-contained  executable . 

Q  What  is  a  self-contained  executable? 

A  That  is  a  program  that  does  not  need  any 

other  libraries  or  any  other  files  run.      It  has 
everything  it  needs  built  into  itself. 

Q  When  you  say  library,   what  do  you  mean? 

A  When  programming  files  on  windows  computers 

there  are  various  libraries,   one  is  a  mouse  library. 
It  does  not  need  that.      It  has  all  the  components 
rolled  into  it . 

Q  Is  there  a  difference  between  a  program  and 

a  executable? 

A  They ' re  synonymous .      Same  thing . 

Q  And  before  we  keep  going,    in  your  own 

words,   what  is  a  essentially  a  program  or  executable? 
Specifically  how  does  it  distinguish  from  another  type 
of  file? 

A  It  is  a  program.     A  program  is  a  file  that 

can  interface  with  the  operating  system  to  execute  a 
task . 
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Q  Based  on  your  experience  with  Windows 

computers  is  there  any  process  or  limitation  that  could 
be  used  to  prevent  a  program  for  being  installed  on  a 
computer? 

A  Yes . 

Q  What  is  that? 

A  It  would  be  administrator  level  privileges 

to  install  a  program. 

Q  Based  on  your  experience  of  Windows  XP 

computers  is  there  any  process  or  limitation  that  could 
used  to  prevent  a  self —executable  file  from  being 
installed  on  a  computer? 

A  A  self-deaned  executable  is  not  a  file  that 

can  be  installed.      It's  a  single  file. 

Q  How  is  it  that  a  —  how  does  a 

self-executable  get  moved  to  a  computer  to  run  it  if 
it ' s  not  installed? 

A  You  copy  it  from  the  source? 

Q  Copy  it  over? 

A  To  the  user  account . 

Q  So  then  in  your  experience  is  there  a  way 
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that  Windows  XP  computers  prevent  the  user  from  copying 
over  self —executable  files  onto  a  computer  from  an 
external  drive? 

A  No,  sir. 

Q  Based  on  your  experience  of  Windows  XP 

computers  is  there  any  process  or  limitation  to  prevent 
a  self —executable  file  from  being  run  on  a  computer  or 
any  other  storage  device? 

A  Sorry,    sir,   would  you  repeat  that  question? 

Q  Based  on  your  experience  with  Windows  XP 

computers,    is  there  any  process  or  limitation  that 
would  be  used  to  prevent  a  self —executable  file  from 
being  run  on  a  computer  or  an  external  media  device? 

A  There ' s  a  HBSS  host  base  security  system 

which  is  a  Department  of  Defense  program  which  has  a 
lot  of  policies.      It  can  prevent  a  file  like  that  from 
being  run . 

Q  And  so  specifically  can  this  HBSS  prevent  a 

self —executable  run  on  a  computer  or  from  its 
prevalence? 

A  Yes . 
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Q  During  your  examination  of  document    .22  .40 

what  operating  system  was  installed? 
A  Windows  XP . 

Q  And  was  HBSS  installed  on  those  computers? 

A  No,  sir. 

Q  To  the  best  of  your  knowledge,   when  you 

were  still  in  the  Department  of  Defense,    did  the 
Department  of  Defense  use  HBSS  technology  on  SIPRnet  in 
2009/2010? 

THE  COURT:      HBSS  or  HBSS? 
THE  WITNESS:  B. 
BY  MAJOR  FEIN: 
Q  What  does  that  stand  for . 

A  Host  Based  Security  System. 

Q  From  your  examination  of  the   .22  and  .40 

computers,   was  there  any  computer  technological 
limitation  from  running  a  self —contained  file  from  the 
hard  drive  or  peripheral? 
A  No. 

Q  So  based  on  your  exam  of  PFC  Manning ' s 

SIPRnet  computers,   what  was  the  only  way  a  user  could 
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be  prevented  from  either  copying  a  self —contained 
executable  over  or  running  one  from  a  CD? 

A  Policy  was  one .      To  remove  it  from  the  CD 

was  to  prevent  it  from  being  copied  from  a  CD  would  be 
to  remove  the  CD . 

Q  I'm  sorry? 

A  The  technical  notation  would  be  to  remove  a 

CD  player  from  the  computer  so  you  cannot  copy  it  off. 
Remove  USB  ports,   but  that's  it  for  technology. 

Q  So  just  to  make  sure  the  Court  understands . 

You're  saying  remove  the  actual  physical  CD  ROM  from 
out  of  the  computer? 

A  Right . 

Q  In  your  experience  of  PFC  Manning   .22  and 

.40  computers  did  you  find  any  evidence  of  WGet  being 
run? 

A  I  did. 

Q  Where  did  you  find  that  evidence? 

A  From  the  prefetch  file. 

Q  What  are  prefetch  files? 

A  This  is  a  Windows  program  that  is  a  Windows 
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system  file  that ' s  created  to  help  Windows  start 
programs  faster  the  next  time  you  use  them. 

Q  How  does  Microsoft  Windows  use  the  prefetch 

file? 

A  When  a  programs  is  first  run,    a  prefetch 

file  is  created.      It  contains  some  information,    some  of 
the  memory,    some  of  the  file  is  kept  there.      So  when 
you  double  click  the  program  a  second  time  it's 
injected  into  the  RAM  faster.      So  this  is  a  Windows 
idea  to  speed  up  launching  of  programs . 

Q  And  could  you  give  the  Court  an  example, 

use  Microsoft  Outlook  as  an  example  of  how  Windows 
would  use  these  prefetch  when  you  run  Microsoft 
Outlook? 

A  The  first  time  you  launch  Outlook  a 

prefetch  file  would  be  created.      It  would  capture  the 
path  of  where  it  was  run  from  and  against  the  time 
prefetch  file  would  be  created,   but  it  would  capture  a 
part  of  the  program  in  RAM.      So  when  you  terminate 
Outlook  and  you  launch  it  for  the  second  time  it  would 
launch  faster,    it  would  start  faster. 
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Q  Special  Agent  Shaver,   what  is  actually 

contained  within  the  prefetch  files  for  each  program? 

A  The  path  of  the  executable,   the  time  and 

date,   the  date  last  run,   the  date  it  was  created,  how 
many  times  it  had  run. 

Q  What  do  you  mean  by  the  path  of  the 

executable? 

A  Where  it  was  physically  located  on  the 

computer . 

Q  Is  that  similar  to  a  URL? 

A  Yes . 

Q  And  how  is  it  similar? 

A  It  is  just  a  location,   but  it  would  be  a 

location  on  the  local  machine . 

Q  Why  is  the  path  captured  within  the 

prefetch  file? 

A  It ' s  a  Microsoft  decision  to  do  that,  but 

it  allows  you  to,    if  you  have  multiple  instances  of  the 
same  program  each,   program  has  a  prefetch  file.  So 
they  can  all  launch  faster  the  next  time. 

Q  What  do  you  mean  by  multiple  instances  of  a 
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program? 

A  Say  if  you  have  several  copies  of  your 

Outlook,   if  you  had  Outlook  located  on  several 
locations  on  the  computer  that  can  run  they  would 
launch  faster  the  second  time. 

Q  So  what  happens  to  the  prefetch  file  a 

program  is  run  from  a  different  location  on  the  same 
user ' s  computer? 

A  A  new  prefetch  file  could  be  created. 

Q  Special  Agent  Shaver,    I'm  handing  you 

what's  been  marked  as  Prosecution  Exhibit  188  for 
identification.     Would  you  take  a  look  at  that.     Do  you 
recognize  that  document? 

A  Yes . 

Q  What  is  it? 

A  This  is  a  document  I  cited. 

Q  What  is  the  actual  document? 

A  The  document  is  the  —  it ' s  a  listing  of 

prefetch  files  from  the   .22  computer  which  were  created 
by  the  WGet  EXE  program. 

Q  And  how  do  you  recognize  that? 
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A  I  created  this . 

Q  Thank  you. 

THE  COURT:     What  exhibit  is  it? 
MAJOR  FEIN:        Your  Honor,  Prosecution 
Exhibit  188  for  identification.     Permission  to  public, 
Your  Honor . 

THE  COURT :     Yes .     Has  that  is  exhibit  been 
admitted  yet? 

MAJOR  FEIN:     No,    it  has  not,   Your  Honor. 
For  identification. 

BY  MAJOR  FEIN: 
Q  Starting  at  the  top,    Special  Agent  Shaver, 

could  you  please  explain  or  orient  the  Court  on  what  is 
listed  across  the  top  for  this  exhibit? 

A  The  top  is  the  file  I  made,   the  prefetch 

files  for  WGet    (INAUDIBLE)    from  .22. 
Q  Did  you  add  that  title? 

A  I  did. 

Q  What  is  the  first  column? 

A  The  first  column  is  a  line  number.  The 

next  column  is  the  prefetch  file  name  and  that ' s  also 
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has  the  path,   the  date  that  the  prefetch  file  was 
created,   the  date  the  last  that  prefetch  was  last  run, 
the  next  column  is  the  program  which  created  that 
prefetch  file. 

Q  I'll  move  this  for  you. 

A  Thank  you .     And  the  last  is  the  path 

contained  within  the  prefetch  file  of  where  that  WGet 
program  was  run  from. 

Q  So  you've  now  mentioned  just  before  we  get 

into  the  information  contained  within  the  exhibit,  you 
mentioned  the  word  path  twice.     What  is  the  difference 
between  the  first  time  you  said  it  with  the  prefetch 
file  name  and  the  path  for  a  side  of  the  prefetch  file, 
what's  the  difference  between  those  two  paths? 

A  The  first  one  the  column  on  the  left, 

that ' s  the  actual  physical  location  on  the  computer  of 
that  WGet  prefetch  file.     You  can  site  it's  C  Windows 
on  is  prefetch  and  there  is  the  WGet  prefetch  files . 

The  path  on  the  right  is  looking  within 
those  individual  prefetch  files  and  it  shows  you  where 
WGet  was  run  from. 
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Q  Now,   when  you  say  run  from,   what  do  you 

mean? 

A  The  location  on  the  hard  drive  where  it  was 

executed. 

Q  And  how  did  you  create  this  exhibit 

Prosecution  Exhibit  188  for  identification? 

A  This  is  a  using  the  Encase  forensic  program 

extracted  this  information. 

Q  What  information  did  you  extract  and  what 

information  did  you  add? 

A  I  added  the  first  column  which  is  line 

numbers  and  the  column,   the  fifth  column,    the  program 
switch  which  created  the  prefetch  files  and  I  also 
created  the  header. 

Q  On  the  top? 

A  Yes . 

Q  And  is  this  a  fair  and  accurate 

representation  of  the  information  that  you  pulled  from 
Encase? 

A  Yes . 

Q  What  information  on  this  document  did  you 
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add  —  you  just  explained  that . 

So  going  now  to  the  path  within  the 
prefetch  file  to  the  far  right  could  you  please  explain 
to  the  Court  what  that  means  as  far  as  the  first  entry 
for  number  one? 

A  It  means  that  WGet . exe  was  run  from 

documents  and  settings  that    (INAUDIBLE)    and  that's 
where  it  was  run  from. 

Q  How  do  you  know  that? 

A  Because  that's  within  the  prefetch  file. 

Q  Is  that  automatically  generated? 

A  Yes . 

Q  And  for  another  example  what  about  line  20. 

Start  from  the  line  number  and  explain  line  20.  Start 
from  the  line  number  and  explain  the  whole  line  for  the 
Court  please . 

A  Line  number  20.     First  column  is  the  line 

number,    number  20.      The  second  is  the  physical  location 
of  the  WGet  prefetch  file  on  the. 22  computer.      The  next 
one  is  the  date  it  was  first  created  and  the  date  the 
second  column  —  fourth  column,   excuse  me,   was  the  date 
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it  was  last.  run.     WGet    (INAUDIBLE)   was  the  program  that 
created  the  prefetch  file  path  where  is  run  from,  was 
documents  and  settings .      Settings  bear  that  name  shows 
sending  bradley . manning  my  document  and  before  the 
name . 

Q  When  you  say  a  program  runs  from  their 

WGet,    in  this  instance  where  was  it  physically  saved  to 
another  hard  drive? 

A  It  was  physically  saved  in  the  directory . 

It  was  shown  the,   blue  folder. 

Q  While  this  image  is  still  up,   what  does  the 

term  unknown  mean  in  the  column? 

A  Several  WGet,   the  files  have  been  deleted 

and  rewritten  and  the  contends  have  been  rewritten .  I 
don't  know  where  they  were  run  from. 

Q  When  you  say  the  WGet  file  or  did  you  mean 

the  WGet  prefetch  file? 

A  The  WGet  prefetch  files . 

Q  I'm  going  to  zoom  though  it  to  show  the 

whole  document.     Why  are  there  20  instances  listed 
here ,    2  0  rows  ? 
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A  That  means  WGet  was  run  from  20  different, 

locations  on  that  hard  drive. 

Q  In  your  experience,   why  would  a  user  run 

WGet  from  different  locations? 

A  You  can  using  download  files  —  if  WGet  was 

run  from  multiple  locations  at  the  same  time  they  can 
each  be  downloading  a  large  set  of  files .     So  together 
writing  simultaneously  you  can  download  an  even  larger 
set  of  files . 

Q  Where  did  PFC  Manning  store  WGet  and  run 

the  program  from? 

A  Which  time? 

Q  Well,   what  computer  was  it  stored  on? 

A  This  is  the  .22. 

Q  Did  you  see  any  —  I  asked  you  a  very  broad 

question,   but  based  off  of  your  analysis  at  least  of 
the  prefetch  file  what  was  the  general  location  or  the 
most  specific  location  where  they  all  were  run. 

A  In  my  documents  folder  within  the 

Bradley . manning  user  file. 

MAJOR  FEIN:        Your  Honor,   the  United  States 
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moves  to  admit  Prosecution  188 . 

MR.   TOOMAN:     No  objection,  ma'am. 

THE  COURT:     May  I  see  it.  Prosecution 
Exhibit  188  for  identification  is  admitted. 

BY  MAJOR  FEIN: 

Special  Agent  Shaver,    in  your  career  how 
many  U.S.   Army  computers  or  Windows  have  you  seen 
WGet  on? 

A  Two . 

Q  Which  ones  were  those? 

A  Dot    .22  and  .139. 

Q  Are  those  are  computers  in  this  case? 

A  Yes . 

Q  Once  WGet  is  copied  onto  a  computer  how 

does  a  user  run  WGet? 

A  From  a  command  prompt . 

Q  What  do  you  mean  by  command  prompt? 

A  The  command  prompt  is  a  Windows  program 

which  allows  a  user  to  interface  with  the  operating 
system  and  run  programs  which  have  a  nongraphical 
interface . 
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THE  COURT:     What  does  that  mean? 
THE  WITNESS :     A  graphical  interface .  You 
can  use  your  mouse,   you  can  click  on  it.  The 
nongraphical  is   just  a  text,   there's  no  pictures. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    do  one  of  the  slides 

you  created  help  demonstrate  what  that  looks  like? 
A  Yes . 

Q  Which  slide  is  that. 

A  Slide  4 . 

MAJOR  FEIN:        Your  Honor,   permission  to 
publish  slide  4 . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,   before  we  continue 

just  to  seek  clarification  for  the  record,   what  is 
this? 

A  That  is  a  command  prompt . 

Q  And  how  did  you  create  this  image  of  a 

command  prompt? 

A  I  created  a  Windows  XP  virtual  machine .  I 
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then  created  —  added  the  user  Bradley . manning  and  from 
that  I  logged  as  that  profile.      I  then  started  at  the 
command  prompt  and  I  took  this  screen  shot . 

Q  I'm  going  to  ask  you  about  how  you  started 

the  command  prompt.     We'll  get  to  that  in  a  moment,  but 
just  again  is  this  from  PFC  Manning's  actual  computer? 

A  No. 

Q  And  how  did  you  create  this  demonstrative 

aid? 

A  Again,    I  created  a  Windows  XP  virtual 

machine.  I  added  a  user  account  named  bradley . manning . 
I  logged  into  that  using  the  user  account .  I  started  a 
command  prompt  and  I  took  this  screen  shot . 

Q  So  going  back  to  the  Court ' s  question  about 

graphical  user  interfaces,    how  does  the  command  prompt 
that  is  displayed  up  here,   how  does  one  use  the  command 
prompt  in  general? 

A  You  would  enter  commands  by  text . 

Q  And  what  do  you  actually  mean  by  that? 

A  You  have  to  actually  type  out  the  commands . 

In  this  case  WGet  and  it  would  you  put  several  options, 
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you  would  identify  the  location  of  the  file  where  you 
would  like  to  download  it  from  and  then  would  you  hit 
enter . 

Q  When  you  use  the  command  prompt,    do  have  to 

use  a  mouse  to  click  on  options? 
A  No. 

Q  And  does  the  command  prompt  let  you 

navigate  web  pages? 
A  No. 

MAJOR  FEIN:        Your  Honor,    I'm  pulling  off 
slide  4  of  the  exhibit . 

BY  MAJOR  FEIN: 
Q  What  happens  when  a  user  double  clicks  a 

program  in  Windows  XP? 

A  A  program  start . 

Q  Does  that  matter  if  it ' s  a  installed 

program  or  is  that  true  for  an  installed  program? 
A  Yes . 

Q  Is  that  also  true  for  a  self —contained 

executable? 

A  It  depends  on  the  executable.     What  its 
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function  is. 

Q  And  what  do  you  mean  by  that? 

A  If,    for  example,   the  something  executable 

is  WGet  you  double  click  on  it .      The  command  prompt 
would  open  and  close  and  it  would  not  do  anything. 

Q  Why? 

A  Because  it  was  never  —  there ' s  no 

graphical  component .     Again  it ' s  a  command  line  tool 
only . 

Q  So  how  does  WGet  run? 

A  It  runs  by  use  of  through  a  command  line . 

You  type  WGet .     You  would  tell  it  time  what  you  would 
like  to  save,   the  file  name  and  where  would  you  like  to 
get  file  from. 

Q  Are  there  options  that  a  user  has  when  they 

run  WGet? 

A  Yes,  sir. 

Q  And  how  does  one  learn  of  those  options? 

A  In  the  command  prompt  if  you  type  WGet  and 

you  put  space  dash  H,    H  for  home,    you  hit  enter,  the 
help  file  will  appear  on  the  screen. 
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MAJOR  FEIN:  Your  Honor,  I'm  handing 
Special  Agent  Shaver  Prosecution  Exhibit  189  for 
identification . 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    could  you  please 

review  that  and  let  me  know  when  you're  finished. 
What  is  that  document? 
A  This  is  a  document  that  I  pulled,  I 

extracted  from  the    .22  computer  from  bradley . manning ' s 
user  profile.      It  is  the  WGet  help  output  file. 

Q  How  do  you  recognize  that  document? 

A  My  initials  are  on  it . 

Q  Have  you  seen  the  information  on  that 

document  before  you  report  finding  it  on  PFC  Manning  — 
A  I  have . 

Q  Where  have  you  seen  the  information  within 

t  hat  do  cument  ? 

A  The  use  of  WGet . 

Q  What  did  you  mean  by  that? 

A  At  CCIU  I  used  WGet  on  a  regular  basis. 

MAJOR  FEIN:     Your  Honor,   permission  to 
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publish . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    could  you  please 

explain  briefly  what  this  document  —  explain  what  the 
document  is  is  trying  to  explain? 

A  How  do  use  WGet .      It  is  a  three-page 

document  of  all  of  the  options  you  can  do  with  WGet  and 
this  is  the  command  line  you  would  have  do  build  to 
make  it  run . 

Q  And  what  do  you  mean  by  options? 

A  To  do  something  it ' s  a  choice .  For 

example,   the  dash  capital  O.     Do  you  see  that. 

Q  Where  with  is  dash  capital  O? 

A  It's. 

Q  Is  it  under  a  subsection? 

A  Yes ,    download . 

Q  Is  the  second  down  from  download? 

A  It  is. 

Q  Please  go  ahead.     What  about  capital  O? 

A  That  writes  documents  to  a  file.      So  if  you 
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download  a  file  it  will  tell  you  the  file  name  at  this 
time  will  write  that  file  name . 

Q  So  when  a  user's  running  WGet,    how  does  one 

download  a  file  or  file  name  that  you  just  described? 
What  do  they  have  to  put  into  the  command  prompt? 

A  They  would  have  to  put  WGet  space  dash 

capital  O  and  a  file  name  filed  by  a  URL  of  the 
location  of  the  file  would  you  like  to  download. 

Q  What  do  you  mean  again  by  the  URL? 

A  That  is  a  location  on  the  Internet  where 

the  file  resides . 

Q  Going  back  to  these  options .     How  many 

options  to  you  estimate  there  are  for  running  WGet? 

A  There  are  three  pages.     Quiet  a  few. 

Q  Three  pages  worth  of  these  types  of 

options? 

A  Yes . 

Q  So  what  does  a  user  have  to  figure  out 

ahead  of  time  before  they  run  WGet? 

A  What  they  want  to  do.      They  need  to  first 

identify  where  the  file  is  on  the  Internet,   where  they 
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want  to  download  it  from. 

Q  Why  does  a  user  need  to  know  where  and  what 

file  they  need  to  download? 

A  WGet  needs  a  specific  location  of  the  file 

on  the  Internet  to  be  downloaded. 

Q  What  else  must  a  user  do  before  they  can 

run  WGet?     You  mentioned  they  have  to  identify  a 
certain  document? 

A  They  need  the  full  path  of  the  document, 

obviously  have  WGet  and  where  they  want  to  store  it . 

Q  You're  talking  about  if  you  assume,  and 

please  correct  me  if  I'm  wrong,   that  this  is  only  if 
you're  downloading  a  single  document,  correct? 

A  Correct . 

Q  But  there  are  other  ways  to  run  WGet? 

A  Yes ,   many . 

Q  And  why  must  a  URL  or  address  be  specific? 

A  The  Internet  is  not  vague,    it  has  to  be 

specific  address  to  find  a  specific  file. 

Q  So  once  a  user  puts  in  this  information  in 

the  command  prompt,   what  do  they  do? 
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A  Command  it . 

Q  What  happens  then? 

A  With  WGet  download,   navigate  to  the  URL  in 

question  and  download  the  file  that  you  receive  and 
save  as  the  file  name. 

MAJOR  FEIN:     United  States  Prosecution  189. 
MR.   TOOMAN:     No  objection. 
THE  COURT:     May  I  see  it,  please? 
Prosecution  Exhibit  189  for  identification  is  admitted. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    did  one  of  the  slides 

explain  the  components  of  a  WGet  file? 
A  Yes . 

Q  What  slide? 

A  Slide  number  three . 

MAJOR  FEIN:     Your  Honor,   permission  to 

publish  183. 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    could  you  please 

explain  how  did  you  create  that  slide? 
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A  I  made  up  a  web  address  and  I  looked  at  the 

help  file  and  I  broke  it  down  by  sections . 

Q  So  could  you  please  explain  to  the  Court 

based  on  this  slide  how  a  user  would  download  a  single 
file  from  a  known  web  server? 

A  The  left  right  is  WGet  is  the  first  one  in. 

The  next  one  is  dash  capital  O  and  the  file  name  l.PDF. 
This  is  what  you  want  to  save  and  where  you  want  to 
save  it . 

The  next  block  is  the  web  address  of  the 
web  server  and  where  it ' s  located  on  the  Internet  and 
finally  the  last  blocks  the  file  name  would  you  like  to 
download. 

Q  Now,    Special  Agent  Shaver,    you  said  that 

the  dash  capital  O  and  then  you  didn't  say  space,  but 
there's  a  space  over  there  as  a  file  name  where  you 
want  to  save  it.     What  do  you  mean,   where  you  want  to 
save  it? 

A  The  path  to  where  you  want  to  save  a  file . 

If  run  a  WGet  from  one  folder  and  you  would  like  to 
save  it  to  another  you  would  have  to  put  it  on  a 
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different  path  so  the  program  knows  to  store  the  file. 

Q  If  you  do  not  put  this  path  information  in, 

like  this  example  here,   where  does  that  file  that's 
being  downloaded  on  WGet,   where  does  it  store  on  the 
hard  drive? 

A  The  same  folder  that  WGet  is  run  from. 

MAJOR  FEIN:     Your  Honor,    removing  slide 
three  of  prosecution  Exhibit  187  for  identification. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    did  you  visit  the  web 

site? 

A  I  did. 

Q  Did  it  have  a  web  page? 

A  It  did. 

Q  What  was  that  address  for  URL. web  page. 

A  NCD . state . sgov . gov . 

Q  What  is  that,   the  website  or  web  page? 

A  That  is  the  website. 

Q  What's  the  actual  address  of  the  web  page 

for  the  NCD? 

A  HTTP : //NCD .state . sgov . gov . /index . HTML . 
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Q  When  you  were  on  that  web  page  was  that  the 

main  page  from  NCD  database? 
A  Yes. 

Q  How  do  you  know  that? 

A  I  went  there . 

Q  And  did  that  web  cite  give  you  an  option  to 

view  cables  on  its  face? 

A  No,   you  had  —  there  was  a  search  function. 

Q  Did  you  attempt  to  search  for  a  cable? 

A  I  did. 

Q  Did  you  search  nor  a  cable? 

A  I  did. 

Q  What  happened  once  you  searched  for  the 

cable . 

A  I  was  present  with  a  choice  and  you  could 

click  on  the  cable  and  view  the  contents. 

Q  When  you  clicked  on  the  cable  to  use  its 

contends,   what  happened  on  your  computer  when  you 
clicked  on  the  cable? 

A  It  displayed  within  my  web  browser. 

Q  Is  that  an  example  of  a  link  to  another  web 
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page  you  testified  about  earlier? 
A  Yes . 

Q  And,    in  general,   why  did  you  go  to  NCD 

database  for  this  case? 

A  I  was  told  NCD  cables  were  involved  in  this 

case .      I  had  never  seen  one  before  and  I  wanted  to  see 
what  one  looked  like . 

Q  When  did  you  go  to  the  web  page? 

A  Summer  of  2010. 

Q  Now,    I ' d  like  to  focus  your  testimony  on 

how  PFC  Manning  ran  WGet  on  his  SIPRnet  computer.  You 
testified  earlier  that  the  multiple  folder  within  my 
documents . 

I'm  now  going  hand  you  PE100  for 
identification.      This  is  a  previously  marked. 

THE  COURT :     Which  exhibit  are  you  pulling? 

MAJOR  FEIN:     Prosecution  100  for 
identification,  ma'am. 

BY  MAJOR  FEIN: 
Q  I'm  now  handing  you  Prosecution  Exhibit~100 

for  identification. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 

99 

A  Okay . 

Q  Do  you  recognize  that  document? 

A  I  do. 

Q  And  what  is  that  document? 

A  This  is  the  document  backup  that  XLXS  which 

I  extracted  from  the   . 22  computer  from  the 
bradley . manning  user  profile. 

Q  How  do  you  recognize  that  document? 

A  I  created  the  screen  shot . 

Q  Is  that  same  document  previously  testified 

about  a  month  ago  with  — 
A  Yes. 

MAJOR  FEIN:     Permission  to  publish  Your 

Honor . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Can  you  please  explain  for  the  Court  first 

of  what  file  type  did  this  screen  shot  come  from,  what 
file  and  what  was  its  file  type? 

A  This  was  an  Excel  spreadsheet  and  the  file 

type  would  be  XLX. 
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Q  What  does  the  WGet  at  the  bottom  left  of 

the  exhibit  show? 

A  That  is  the  sheet  of  the  workbook . 

Q  And  now  just  using  the  top  portion  as  an 

example,   what  does  this  exhibit  show? 

A  It  shows  WGet  dash  capital  O  save  any  file 

as  10  canbara  153.HTMO  from  the  web  server 
HTPP : //NCD . state . sgov . gov  and  a  slash  message  slash 
similar  reference  and  the  file  is  downloading  is  10 
canbara    (INAUDIBLE)  153. 

Q  So  going  through  this  example  and  you  write 

line  10926? 

A  Right . 

Q  What  web  server  is  the  file  being 

downloaded  from? 

A  The  NCD  web  server . 

Q  How  do  you  know  that? 

A  From  the  address. 

Q  And  what  is  the  file  name  of  the  file 

being  —  what  is  the  file  name  of  the  file  on  the 
server? 
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A  The  file  name  is  10  canbara  153. 

Q  And  do  you  recognize  that  naming  convention 

for  our  investigation? 
A  Yes . 

Q  What  is  that? 

A  That  is  an  MRN. 

Q  What  is  an  MRN? 

A  Message  record  number. 

Q  Where  have  you  seen  that  in  general? 

A  Through  this  case  and  on  the  NCD  website, 

sir . 

Q  Now,    is  there  a  file  type  associated  like 

on  this  prosecution  exhibit  for  identification  with 
what ' s  sitting  on  the  web  server? 

A  No. 

Q  And  what  file  type  is  it  being  served  at? 

A  HTML. 

Q  How  do  you  know  that? 

A  Because  it  says  ways  WGet  space  dash 

capital  O  10  canbara  15. 

Q  Now,   what  information  would  PFC  Manning's 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


102 

machining  need  in  order  to  create  this  Excel  document 
with  WGet  commands  and  specifically  what  pages  on  the 
web  server? 

A  You  first  need  to  know  obviously  the 

address,   the  URL  of  the  web  server  and  all  the  specific 
path  to  the  files  and  a  listing  of  the  files  he  would 
like  to  have  downloaded. 

Q  Why  do  you  need  the  list  of  the  files  that 

you  want  to  download  or  why  would  he  need  the  list  of 
those  MRNs? 

A  You  needed  to  downloaded  them,   wanted  to 

downloaded  them,   and  he  needed  a  list  of  what  do 
downloaded . 

Q  Would  WGet  have  worked  otherwise? 

A  I  don't  think  so  because  the  NCD,  these 

files  were  not  linked  on  mass  to  the  front  web  page . 
There  was  a  database  more  or  less  in  the  back  end.  So 
the  user  would  have  to  search  the  NCD . state . sgov . gov 
(INAUDIBLE)    server  to  identify  the  cable  they  wanted  to 
download . 

Q  In  order  to  obtain  the  information  of  the 
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actual  cables  and  their  names  on  the  server,   what  would 
PFC  Manning  need  to  be  able  to  do  or  what  did  he  need? 

A  He  needed  the  address .     He  needed  the  cable 

names . 

Q  And  did  you  find  any  evidence  of  how  he 

obtained  the  cable  names? 
A  Yes. 

Q  What  evidence  did  you  find  of  how  he  did 

this? 

A  On  Intel  Link  there  was  a  search  from  the 

.22  computer  to  the  NCD.state.sgov.gov  and  a  query  was 
like  a  search  of  new  cables .      It  was  a  listing  and  it 
provided  a  list  of  the  hundred  cables  or  so. 

Q  And  did  that  result  give  a  list  of  the 

cable  names? 

A  It  showed  up,  yes. 

Q  And  then  what  at  least  could  a  user  do  with 

a  list  of  cable  names? 

A  In  this  case  copy  them  and  then  place  them 

into  Excel . 

Q  When  you  examined  this  Excel  worksheet,  or 
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excuse  me,   this  backup  XLX  text  file,   what  did  you 
observe  on  how  PFC  Manning  created  these  WGet  commands? 

A  If  you'll  notice  at  the  top  that  says 

column  B.      Column  A  is  nothing  but  the  names  itself 
with  no  extensions  and  a  canbara    (INAUDIBLE) . 

What  happened  is  this  is  a  —  this  is  a 
function  of  Excel  and  concatenate  the  contents  of  the 
first  half,   the  first  column,   which  would  just  be  the 
names  and  it  created  this  output . 

Q  What  do  you  mean  by  concatenate? 

A  Concatenate  is  a  Excel  function  to  put 

pieces  together.      In  this  case,   this  would  —  he 
would  —  it  was  going  to  get  WGet  dash  O  and  then  it 
had  instead  of  the  file  name  from  to  10  canbara  153  it 
actually  read  the  column  A  and  then  it  would  put  that 
in  there  automatically  and  filed  by   .HTML  and  then  it 
would  have  that  address  and  reference  and  it  would  read 
in  column  A  to  populate  this  field.      It  was  a  way  of 
being  automated? 

THE  COURT :      Let  me  stop  you .     Where  do  you 
get  the  information  from  column  A? 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


105 

THE  WITNESS :      That ' s  where  you  read  the 
names.     You  can  go  to  NCD,    you  would  search  for  in  this 
case  the  newest  cables .     You  would  say  here  are  your 
cables.     You  copy  that  list  of  names,   populate  it  into. 

BY  MAJOR  FEIN: 
Q  And  just  that  last  portion.     How  would  a 

user  do  that?     You  have  the  web  page  you  said  and  you 
the  newest  100  cables?     What  would  you  do  on  the 
computer? 

A  Highlight,    copy  it,    and  then  paste  it  into 

Excel . 

Q  And  then  once  you  paste  it  into  Excel  based 

off  the  formulas  in  Excel  what  would  you  have  in  this 
column  that  you're  looking  at? 

A  This  would  populate  it .      It  would  then 

create  WGet  commands . 

Q  Is  that  an  automated  process? 

A  It  would  be,  yes. 

MAJOR  FEIN:        Your  Honor,   United  States 
moves  to  admit  Prosecution  100  for  identification  as 
Prosecution  Exhibit~100 . 
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MR.   TOOMAN:     No  objection,  ma'am. 
THE  COURT:     Prosecution  Exhibit~100  for 
identification  is  admitted. 

BY  MAJOR  FEIN: 
Q  Now,   based  off  of  your  analysis  of  PFC 

Manning's  computer,   what  did  then  PFC  Manning  do  with 
that  Excel  spreadsheet  with  the  WGet  commands? 
A  You  mean  .22? 

Q  Yes . 

A  He  then  would  have  copied  column  B  into  a 

batch  file  and  then  run  the  command. 
Q  What  is  a  batch  file? 

A  That  is  a  file  that  contains  limited 

instructions  for  programs  to  run  in  through  command 
prompts .     You  read  the  first  one  and  once  it  does  the 
second  line  and  third  line  and  so  on  until  it ' s  done . 

Q  Why  would  a  batch  file  be  needed  in  order 

to  run  WGet? 

A  Because  in  this  matter  the  way  this  was 

done  he  would  have  to  either  run  them  in  mass  as  a 
batch  file  or  copy  and  paste  each  one  into  command 
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prompt,   hit  enter.      It  would  download  copy  and  paste, 
and  this  was  just  a  way  to  automate  it . 

Q  What  final  type  is  associated  with  batch 

files? 

A  The  file  type  as  .BAT. 

Q  How  does  a  user  create  a  batch  file? 

A  The  easiest  way  is  to  open  notepad,  which 

is  a  text  editor,   and  put  your  contents  in  there  and 
then  save  it  as  a  file  extension  .bat. 

Q  Is  a  batch  file  a  graphical  user  interface? 

A  It  is  not . 

Q  What  is  it? 

A  It  is  a  —  again,    it's  just  a  command. 

It ' s  a  series  of  linear  steps  for  the  command  prompt  to 
execute . 

Q  And  did  you  find  any  evidence  of  a  batch 

file  being  used  by  PFC  Manning? 
A  I  did. 

Q  What  did  you  find  in  the  unallocated  space? 

A  In  the  unallocated  space  I  found  a 

partially  deleted  remanence  of  a  batch  file. 
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Q  Special  Agent  Shaver,    I'm  now  handing  you 

Prosecution  Exhibit  190  for  identification.     Do  you 
recognize  that  document? 

A  I  do. 

Q  And  how  do  you  recognize  that  document? 

A  This  is  a  document  I  created.      This  is  a 

extract . 

MR.   TOOMAN:     We've  just  seen  this  for  the 
first  time.     We'd  like  the  opportunity  to  talk  about 
this  document  with  our  expert . 

THE  COURT :     How  long  do  you  need?  Any 

objection . 

MAJOR  FEIN:     No,  ma'am. 

THE  COURT:      The  Court  will  be  in  recess  for 

15  minutes . 

(Hearing  recessed  at  4:38  p.m.) 

(Hearing  resumed  at  5:00  p.m.) 

THE  COURT:     Major  Fein,    did  you  have 
anything  you  wanted  to  do  on  the  record? 

MAJOR  FEIN:     Yes,   ma'am.     Earlier  when  the 
Court  came  out  to  ask  the  question  about  the  641 
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offenses,   when  asking  the  United  States  I  stated  that 
the  charge  sheet  specifically  stated  that  the  641 
offenses  state  that  a  database  containing  —  this  is 
for  the  CIDNE  641  offenses.      That  CIDNE  contained 
SigActs  and  the  actual  charge  sheet  that  is  the  CIDNE 
database  containing  records,   not  SigActs. 

THE  COURT:      Let  the  record  reflect  that  the 
witness  is  on  the  witness  stand. 

BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    I'm  showing  you 

Prosecution  Exhibit  190  for  identification.     Have  you 
seen  this  document  before? 

A  I  have . 

Q  What  is  this? 

A  This  is  a  screen  shot  of  the  —  from  the 

.22,   the  allocated  space.      It's  a  screen  —  this  is 
something  I  created. 

Q  How  do  you  recognize  it? 

A  I  created  this . 

Q  And  what  is  a  screen  shot  of? 

A  The  unallocated  space .      It  was  a  deleted 
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batch  file . 

MAJOR  FEIN:     Your  Honor,   permission  to 

publish . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 

Q  Now,   before  we  broke  you  testified  about 

the  use  of  batch  files  and  the  different  places  you 
found  evidence  of  batch  files  being  run. 

So  where  did  this  information  that ' s  on 
this  exhibit  come  from? 

A  The  unallocated  space  within   . 22 . 

Q  And  could  you  please  explain  to  the  Court 

what  this  extract  for  that  unallocated  space  shows? 

A  It  shows  a  series  of  WGet  commands 

downloading  a  number  of  MRNs,    Department  of  State 
cables  from  the  Department  of  State  server . 

Q  How  does  this  extract  compare  to  at  least 

format— wise,    and  content— wise,    to  the  WGet  tab  on  the 
back  up  XLX  file? 

A  It  has  the  same  content,    same  format,  WGet 

space  dash  capital  O  space  message  record  number  .HTML, 
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the  web  assess  to  NC  state  and   (INAUDIBLE)    finally  the 
file  which  is  being  downloaded. 

Q  And  why  do  you  conclude  that  this  is  a 

recovered  batch  file  from  his    .22  SIPRnet  computer? 

A  Because  that  is  what  script  would  have 

looked  like .      It ' s  just  a  linear  set  of  commands . 

Q  And  when  a  batch  file  such  as  this  one  is 

run,   what  does  the  computer  do? 

A  It  reads  the  first  line  and  executes  it  and 

then  the  next  line  and  continues  on  through  until  it 
runs  out  of  commands . 

MAJOR  FEIN:        Your  Honor,   United  States 
moves  to  admit  what  has  been  marked  Prosecution  Exhibit 
190  identification  as  Prosecution  Exhibit  190. 

MR.   TOOMAN:     No  objection,  ma'am. 

THE  COURT:     Prosecution  Exhibit  190  is 

admitted. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,   what  is  the  NT  user 

file  DAT  file? 

A  That  is  a  Window's  registry  file  that 
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pertains  to  a  specific  user  on  a  Windows  computer. 

Q  What  do  you  mean  by  a  Windows  registry 

file? 

A  That  is  a  file  that  every  user  on  the 

computer  has  and  it  maintains  information  that  in  user 
account.     For  example,   the  last  ten  documents,  the 
office  documents,   that  is  maintained  within  your  NT 
user  file. 

Q  Is  this  a  file  that's  generated  by  the  user 

or  is  it  automated? 

A  It  is  an  automated  file  populated  by 

Windows . 

Q  In  your  example  when  you  said  like  a 

Microsoft  file,    is  it  a  general  Microsoft  office  file 
or  is  it  by  file  type? 

A  It's  by  file  type. 

Q  And  what  information  does  it  log  when  it 

comes  to  file  types? 

A  It  will  show  you  the  last  ten  times  that 

file  type  has  been  accessed. 

Q  Was  there  any  evidence  in  PFC  Manning ' s 
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NTuser.DAT  file  of  batch  files  being  run  on  his  SIPRnet 
computer? 

A  Yes. 

Q  How  do  you  know  that? 

A  Within  the    .22  profile   .22  on  the 

bradley . manning  user  profile  I  explained  in  that  that 
it  maintained  the  last  ten  batch  files  which  would  have 
been  accessed. 

Q  Special  Agent  Shaver,    I'm  now  handing  you 

Exhibit  191  for  identification.     Would  you  please  look 
at  that? 

A  Yes,  sir. 

Q  What  is  that  document? 

A  This  is  a  document  I  created.      This  is  a 

screen  shot  of  the    (INAUDIBLE)    concerning  the  batch 
files,    last  ten  batch  files. 

Q  What  do  you  mean  by  concerning? 

A  That ' s  what  it  is .      These  are  the  last  ten 

batch  files  which  were  opened  and  saved. 

Q  How  do  you  recognize  that  document? 

A  I  created  it . 
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Q  Thank  you.     Permission  to  publish? 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Starting  from  the  top  down  could  you  please 

explain  for  the  Court  what  that  exhibit  is? 

A  The  first  line  is  the  actual  key  where  this 

information  was  stored.      The  next  line  is  the  last 
written  time  that  he  had  been  updated. 
Q  What  do  you  mean  by  key? 

A  The  registry  stores  keys .     Registry  files 

maintains  files  and  information  by  the  use  of  keys . 
It ' s  like  a  database  and  each  record  would  have  its  own 
information . 

Q  And  what  is  the  key  that ' s  being  used  for 

this  exhibit? 

A  It's  located  on  Windows  current  version  of 

Explorer  com  DLG  32  open  save  MRU  bat . 

Q  What  does  the  bat  at  the  end  of  that  key 

mean? 

A  That  is  the  batch  files .     Anything  with 

a. bat  extension  is  there,   the  last  ten. 
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Q  And  now  what  about  the  last  class  name  the 

top  portion  of  this? 

A  The  last  written  time  is  last  time  in  this 

batch  file  a  registered  key  would  have  been  updated. 
What  that  means  is  the  last  time  that  something  —  a 
batch  file  had  been  opened  and  saved. 

Q  And  now  what  does  the  first  line  under  name 

type  and  data,   what  does  that  first  line  mean? 

A  That  means  the  order  of  which  things  were 

put  in . 

Q  What  do  you  mean  by  things  put  in . 

A  The  registry  keys.      If  you  look  at  the  left 

it  says  MRU  list  and  then  it  has  the  first  one  as  IGED 
if  you  read  down.      If  you  look  from  left  to  right  under 
the  top  data  field,   again,   has  the  order  of  which 
the  —  they  were  put  in  there.     A  was  the  first,    B  was 
the  last,   and  then  it  goes  up  to  I  as  being  the  newest 
document . 

Q  And  then  what  does  the  information  show 

below  that  first  line  where  it  says  MRU  list  and  the 
IGD? 
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A  It  shows  the  path  of  the  batch  files  which 

have  been  run . 

Q  What  did  you  bean  my  path? 

A  The  physical  location  on  the  hard  drive. 

Q  What  did  your  observe  and  do  you  observe 

about  the  these  last  ten  bath  files? 

A  They  were  all  run  from  the  bradley . manning 

user  profile  under  the  documents  in  the  folder  bloop. 

Q  And  how  does  one  determine  how  to  name  a 

batch  file? 

A  You  can  name  it  anything  you  want,   but  you 

must  have  extension  .bat. 

Q  And  so,    for  example,    the  second  line  golf, 

what  does  that  tell  you? 

A  That  tells  me  the  file  move. bat  was  present 

in  the  bloop  folder . 

Q  Why  does  it  tell  you  that? 

A  Because  that  was  the  bath  of  where  it  ran 

from. 

MAJOR  FEIN:        Your  Honor,   United  States 
moved  to  admit  Prosecution  Exhibit  191  for 
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identification . 

MR.   TOOMAN:     No  objection. 

THE  COURT:     Prosecution  Exhibit  191  is 

moved . 

BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    did  you  find  a  folder 

on  PFC  Manning's  SIPRnet  computer  that  contained  a 
batch  file  and  the  associated  files  using  WGet? 

A  I  did. 

Q  Where  did  you  find  that? 

A  It  was  in  the  bradley . manning  user  profile 

on   .22  and  the  folder's  name  was  bloop . 

Q  I'm  retrieving  from  the  court  reporter 

Prosecution  104  for  identification: 

Special  Agent  Shaver,    I'm  now  handing  you 
Prosecution  Exhibit  104  for  identification.     Do  you 
recognize  that  document? 

A  Yes ,    I  do . 

Q  What  is  that  document? 

A  This  is  a  screen  shot  of  the  forensic 

program  that  I  created. 
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Q  Is  that  the  same  exhibit  you  referenced  in 

your  previous  testimony  with  Captain  Morrow? 
A  Yes . 

MAJOR  FEIN:     Permission  to  publish,  Your 

Honor . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    could  you  please 

explain  to  the  Court  what  is  displayed  in  this  exhibit 
that  you  pulled? 

A  What  these  are,   these  are  again  as  previous 

testimony,    you  will  see  the  back  up  .XLXS. 

Q  Where  are  we  looking? 

A  Six  up  from  the  bottom. 

Q  Okay . 

A  And  also  files    .zip.      The  files    .zip  was 

the  partially  corrupted  zip  file  that  we  spoke  of 
earlier,   and  the  second  from  the  bottom  is  move. bat, 
that  is  the  batch  file. 

Q  So  just  to  orient,   what  is  the  left  column? 

A  The  column  with  the  file  name. 
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Q  What  is  the  right  column? 

A  That  is  the  file  creation  time. 

Q  And  what  does  this  left  column  show? 

A  It  shows  the  names  of  the  files  that  are  in 

that  folder . 

Q  And  what  else,   what  kind  of  information  is 

contained  in  that  folder  pulled  from  the  Department  of 
State  server? 

A  There  are  several  MRNs,    deleted  MRNs  that 

are  there  and  the  file. zip  that  contains  over  10,000 
MRNs  from  the  Department  of  State  server . 

Q  What  do  you  mean  by  that? 

A  They  have  been  deleted. 

THE  COURT :     How  many  file  names  did  it 

contain? 

THE  WITNESS:      It  contained  over  10,000. 

THE  COURT :      Thank  you . 

BY  MAJOR  FEIN: 
Q  And  what  do  you  mean  by  —  first  what  does 

that  symbol  next  to  the  MRN  represent? 

A  If  you  look  at  the  first  one  that  symbol 
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means  the  file  has  been  deleted. 

Q  What  is  the  bigger  symbol  next  to  the  MRN? 

A  It  is  a  file.      It  shows  it's  a  file  and  it 

shows  that  it ' s  the  slash  line  through  it  means  it ' s 
been  deleted. 

Q  And  — 

THE  COURT:     What  slash  line? 
BY  MAJOR  FEIN: 

Q  Could  you  use  your  screen  and  circle, 

please? 

A  I'll  try.     Right  there. 

THE  COURT :      Got  it . 
BY  MAJOR  FEIN: 
Q  So  are  you  talking  about  next  to  the  very 

first  entry  10  ancra  2  9 9HTMLHTML  that  there  is  a  icon 
that  looks  like  a  piece  of  paper  with  a  circle  with  a 
slash  through  it? 
A  Yes . 

Q  And  that ' s  what  you  just  circled? 

A  Yes,  sir. 

Q  And  what  do  you  mean  by  it  was  deleted? 
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A  The  file  has  been  deleted.     The  contents  of 

the  file  has  been  deleted,   but  the  entry  within  the 
master  file  table,    the  MFT,    is  still  present. 

Q  And  did  during  forensic  exams  remnants  of 

deleted  files,   Department  of  State  files  specifically, 
were  they  recovered? 

A  Yes . 

Q  And  then  you  talk  about  backup  XLXS,  is 

that  the  file  you  testified  about  earlier? 
A  Yes . 

Q  What  about  move . bat  ? 

A  That  is  a  batch  file.      It  has  been  deleted 

and  the  contents  has  been  overwritten.      I  do  not  know 
what  the  exact  content  of  that  was . 

Q  What  folder  is  this  showing  the  contents 

of? 

A  The  folder  is  bloop . 

MAJOR  FEIN:        Your  Honor,   United  States 
movers  to  admit  Prosecution  104  for  identification  as 
Prosecution  Exhibit  104 . 

MR.   TOOMAN:     No  objection. 
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THE  COURT:     Prosecution  Exhibit  104  for 
identification  is  admitted. 

BY  MAJOR  FEIN: 

Q  So  when  PFC  Manning  was  running  WGet  in  his 

my  documents  folder,   the  way  he  had  programmed  it  where 
did  the  file  save  to? 

A  The  same  folder  the  WGet  was  run  from. 

Q  How  was  that  reflected  in  the  exhibit  that 

was  just  displayed? 

A  The  WGet  files  were  there.      The  HTML  files 

that  would  indicate  WGet  was  run  from  that  folder . 

Q  Would  it  be  in  the  same  folder  as  the  batch 

file? 

A  Yes. 

Q  And  was  that  specific  move. bat  file 

reflected  or  accounted  for  in  the  NT  user. data  file? 
A  Yes . 

Q  Was  running  WGet . exe  in  that  bloop  folder 

contained  in  the  prefetch  file? 
A  It  was . 

Q  Now,    if  WGet  was  run  from  a  CD  or  DVD,  how 
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would  that  be  captured  within  the  same  files  you've  now 
discussed,    if  at  all? 

A  It  would  not  have  —  the  methodology  that  I 

just  used  from  the    (INAUDIBLE)   would  it  not  have  worked 
because  you  cannot  write  to  the  CD .     You  would  have  to 
write  to  somewhere  on  the  computer  within  the  user 
profile . 

Q  Why  is  that? 

A  Because  CDs  are  redundant .     You  need  to  — 

WGet  knows  how  to  —  WGet  can  download  a  file,   but  it 
has  to  be  able  to  write  output  to  something. 
Q  What  if  it ' s  a  rewritable  CD? 

A  Another  program  would  have  to  do  that . 

WGet  does  not  have  that  capability? 

MAJOR  FEIN:        Your  Honor,   permission  to 
publish  slide  2  of  Prosecution  Exhibit  187  for 
identification . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    earlier  you  testified 

as  a  demonstrative  that  this  slide  you  created  shows 
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how  WGet  could  run.     Using  the  same  exhibit  could  you 
please  explain  how  PFC  Manning,    in  your  opinion,  ran 
WGet  from  his  SIPRnet  computer? 

A  First,    he  downloaded  it  from  the  web  site 

using  a  NIPRnet  computer.      In  this  case    .139.      The  file 
was  burned  to  a  CD,    transferred  over  to  the  SIPRnet  22, 
40.     As  in  place  on  —  within  his  user  profile.  He 
then  navigated  to  NCD.state.gov  using  a  web  browser, 
identified  the  cables  that  at  he  wanted  to  download. 
He  then  hocked  them  back  up  that  XOXX,    copied  and 
pasted  those  MRNs  into  that  which  would  then  populate 
the  field  and  create  the  correct  command  line  for  WGet 
to  operate . 

He  would  then  have  copied  the  WGet  all  the 
commands  in.XLX  into  a  batch  file  and  then  executed  had 
batch  file . 

Q  When  that  batch  file  executed,   how  did  WGet 

retrieve  the  web  page  from  the  web  server? 

A  Download  the  file  by  navigating  directly  to 

the  web  server  copying  the  file  from  the  web  server  and 
saved  it  locally  as  an  HTML  file. 
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Q  So  using  your  aid,   what  path  did  it  follow? 

A  The  request  went  up  the  red  line  from  the 

bottom  left  to  the  middle,   went  to  that  one,   and  then 
it  navigated  to  the  files  and  then  the  return  path 
would  have  been  to  a  local  machine . 

Q  And  when  that  occurred  did  PFC  Manning ' s 

computer  go  on  to  the  next  sent  diplomacy  web  page  that 
you  visited  to  search  cables? 

A  WGet  did  not . 

THE  COURT :     Ask  that  question  again . 
BY  MAJOR  FEIN: 

Q  When  PFC  Manning  would  have  run  that  from 

his  SIPRnet  computer,   did  WGet  access  the  web  page  to 
download  the  cables  or  did  it  go  straight  to  the 
server? 

A  It  went  straight  to  the  server. 

MAJOR  FEIN:        Your  Honor,   United  States 
moves  to  admit  Prosecution  Exhibit  187  for 
identification  as  Prosecution  Exhibitl87 . 

MR.   TOOMAN:      I  would  object  that  the 
government  served  that  it  was  demonstrative  and 
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(INAUDIBLE) . 

THE  COURT:     May  I  see  it?     Why  isn't  it  a 
demonstrative  aid  proper  for  admission? 

MR.   TOOMAN:     Your  Honor,    it's  not  evidence, 
it ' s  just  created  by  this  witness . 

MR.   COOMBS:     Additionally  the  witness 
testified  that  it  would  aid  him  in  his  testimony.  So 
this  is  essentially  reinforcing  his  testimony  for  the 
trier  of  fact .      If  it  was  used  as  a  demonstrative  aid 
as  he  was  explaining  his  testimony  to  the  trier  of  fact 
by  admitting  this  it  is  not  evidence  in  the  case .  This 
is  simply  something  that  the  witness  created  on  their 
own  in  order  to  aid  their  testimony. 

THE  COURT :     Demonstrative  evidence  can  be 
admitted  in  this  case.      I  don't  see  any  basis  for  the 
defense  objection.     So  I'm  going  to  go  ahead  and  admit 
it,    understanding  it's  demonstrative. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    now  I'd  like  to 

direct  your  testimony  to  evidence  you  found  of  Twitter 
and  tweets? 
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THE  COURT :     Yes . 

MR.   TOOMAN:     We're  going  to  object. 
Again,    the  government  gave  notice  that  they  would 
elicit  testimony  about  Wikileaks  tweets  that  were 
found  on  the  accused  personal  computer.  No 
Wikileaks  tweets  why  actually  found  on  PFC  Manning's 
Macintosh  computer.      The  witness  would  say  the  URLs 
or  the  link  essentially  to  Wikileaks  tweets  were 
found  on  the  computer . 

So  those  tweets  weren't  actually  found 
on  the  computer .      There ' s  no  evidence  on  the 
computer  that  PFC  Manning  ever  viewed  those  tweets 
or  saw  those  tweets .     There ' s  no  evidence  that  he 
went  to  the  web  page . 

So  he  would  say  it ' s  not  appropriate  for 
rebuttal.      In  addition,   we  get  to  the  point  where  we 
actually  see  the  tweets,   those  tweets  were  totaled 
purpose  of  them  is  to  rebut  the  idea  that  Wikileaks 
is  a  journalistic  those. 

Tweets  have  nothing  to  do  with  whether 
or  not  Wikileaks  is  a  journalistic  organization. 
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THE  COURT:     Well,    the  Court  degrees  with 
that,   but  what  are  you  trying  to  elicit? 

BY  MAJOR  FEIN: 
Q  Your  Honor,    factual.      The  first  parts 

absolutely  tree  and  Special  Agent  Shaver  testified  that 
he  found  the  links  to  these  tweets  and  then  he  went  on 
to  Twitter  and  found  where  they  are .     The  purpose  of 
this  testify  is  exactly  as  articulated  before,  the 
defense  proffered  the  evidence  from  Professor  Bankler ' s 
letter  about  the  relationship  Wikileaks  has  to  the 
press  entity  and  we  intend  to  offer  these  to  show  — 
and  the  defense  intends  to  argue  that  PFC  Manning  knew 
that  then  he  would  have  also  had  evidence  on  them  that 
shows  it  was  not,   and  these  tweets,   as  the  Court  will 
seal  show  that,   or  least  provide  a  reasonable  inference 
that  it  was  not  a  legitimate  news  organization? 

MR.   TOOMAN:     Another  position  on  the 
substance  of  these  tweets  is  that  they  have  no  bearing 
on  Wikileaks '    relationship  to  the  media  or  their 
standing  as  a  journalistic  organization. 

THE  COURT :      I  can  overrule  that .      I'm  going 
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to  let  it  in . 

Go  ahead . 
BY  MAJOR  FEIN: 
Q  For  the  past  two  weeks  have  you  had  the 

opportunity  to  search  PFC  Manning ' s  personal  Mac  for 
any  evidence  of  Twitter? 
A  I  have . 

Q  And  specifically  any  evidence  that  would 

relate  back  to  the  Wikileaks  Twitter  feed? 
A  Yes . 

Q  And  where  did  you  find  evidence  that  you 

answered  yes  to? 

A  In  the  unallocated  space . 

Q  Did  you  find  it  anywhere  else  as  well? 

A  In  the  allocated,   yes . 

Q  Where  in  the  allocated  space? 

A  Within  the  B  Manning  user  profile  there  was 

a  web  browser  called  Sapphire .  Inside  there  was  a 
database  that  contained  information  to  those  files 
pertaining  to  the  substance . 

Q  And  what  file  on  PFC  Manning's  personal 
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Macintosh  computer  did  you  find  in  the  allocated  space 
information  related  to  Twitter  and  Wikileaks? 

A  It  was  a  web  icon . database . 

Q  What  is  that? 

A  If  you  go  to  the  web  —  if  you  open  up  a 

web  browser . 

MR.   TOOMAN:     Your  Honor,   we're  going  to 
object  to  whether  or  not  there  was  evidence  of  Twitter 
or  Wikileaks  on  PFC  Manning's  computer  has  no  bearing 
whatsoever  as  to  whether  or  not  Wikileaks  is  a 
journalistic  organization. 

THE  COURT:     Whether  Wikileaks  is  a 
journalistic  organization,    the  relevant  inquiry  is 
whether  PFC  Manning  believed  they  were,  right? 

MR.   TOOMAN:     Paragraphs,    Your  Honor,  but 
whether  or  not  he  ever  visited  Twitter  or  Wikileaks, 
that's  already  established  on  the  merits  and  certainly 
not  anything  we  offered  in  our  case  in  chief.  It's 
unclear  what ' s  — 

THE  COURT :      I  disagree .      It ' s  proper 
rebuttal  for  Mr.   Bangler ' s  testimony. 
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BY  MAJOR  FEIN: 
Q  What  is  it ' s  web  database? 

A  That  is  the  database  called  favor  corns  and 

those  are  you  recall  icons.      If  you  were  going  to  the 
Washington  Post  web  page  to  the  left  in  the  address  bar 
to  the  left  of  that  would  be  a  little  WP .      It ' s  a  way 
of  branding  their  web  pages .     This  database  maintained 
those  websites  that  have  been  visited. 

Q  And  is  this  database  populated 

automatically  by  a  Mac  or  by  Safari  or  is  it  done  by 
the  user? 

A  Populated  automatically  by  Safari . 

Q  Special  Agent  Shaver,    I'm  handing  you 

what's  been  marked  as  Prosecution  Exhibit  192  for 
identification.     Special  agent,   what  is  that  document? 

A  This  is  a  document  I  created.  This 

contains  the  web  page  icons  database . 

Q  How  do  you  know  that? 

A  I  created  this . 

Q  Where  did  that  information  come  from? 

A  It  came  from  the  file  called  file  located 
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in  the  Macintosh  hard  drive,   the  path  is  users  Bmanning 
weinberry  Safari  far  web  page . 

Q  Was  this  in  the  allocated  or  unallocated 


space 


It  was  allocated. 

MAJOR  FEIN:        Your  Honor,   permission  to 


publish . 


THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 

Q  So  Special  Agent  Shaver,   based  off  of  my 

original  question,   what  information  —  first  of  all, 
what  information  on  this  exhibit  did  you  pull  from  the 
actual  file? 

A  The  second  column  and  the  third  column . 

Q  And  what  are  the  column  names? 

A  You  recall  and  icon  ID . 

Q  What  did  you  add  to  this? 

A  I  added  the  title  above  and  the  line 

numbers . 

Q  What  is  the  title  above  show? 

A  The  math  of  the  file  as  it  was  located. 
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Q  Is  that  the  path  you  just  discussed? 

A  It  is. 

Q  And  what  does  the  number  reflect? 

A  The  just  a  line  number . 

Q  And  are  those  sorted  in  any  way? 

A  That ' s  how  —  when  I  extracted  it  was  the 

order  informs . 

Q  What  does  the  URL  column  show? 

A  It  shows  a  path  to  a  web  site . 

Q  And  go  ahead? 

A  Website  or  web  server  or  individual 

article . 

Q  And  what  does  the  icon  ID  column  tell  you? 

A  This  goes  back  to  the  icons  I  spoke  of.  If 

you  look  at  the  Twitter,   all  the  Twitters  have  the  same 
icon  ID  number  three  on  the  right .      They  all  have  the 
same  icon.      So  Twitter  has  its  own  icon. 

Q  And  what  does  a  user  of  Safari  on  a 

personal  on  a  Macintosh  have  to  do  in  order  to  have 
this  database  populate  with  an  entry? 

A  Go  to  that  web  page . 
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Q  And  what  does  line  4  state? 

A  ACDB  Twitter.com/Wikileaks. 

Q  What  is  that  website? 

A  That  is  the  feed  for  —  the  Wikileaks  feed 

for  Twitter. 

Q  Now,    is  that  the  exact  path  of  the  feed 

today? 

A  No,  sir. 

Q  What  is  different? 

A  Twitter  has  moved  from  HTTP  to  HTTPS . 

Q  And  very  general  terms  what  is  the 

difference  between  HTTP  and  HTTPS? 

A  It  adds  a  secure  socket  to  encrypt  it . 

Q  And  what  does  line  6,   what  does  that  mean? 

A  That  means  Twitter . com  a  search  was 

conducted  for  the  key  word  Wikileaks . 

Q  And  what  about  line  7? 

A  The  same . 

Q  What  about  line  8  and  9? 

A  Line  8  is  a  web  page  Wikileaks . com  path . 

There ' s  a  Wikipedia  and  there ' s  a  document  of 
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apparently  access  U.S.   underscore,  intelligence, 
underscore,   plan  to  destroy  Wikileaks  and  there's  a 
date . 

Q  What  about  line  9? 

A  Line  9  is  a  web  page, 

Wikileaks . com/wiki/wikileaks . 

Q  What  about  16  and  17? 

A  Sixteen  is  web  page,   Wikipedia  concerning 

Julian  Assange. 

Q  And  line  17? 

A  Line  17  is  Wikipedia  web  page  concerning 

the  Wikileaks . 

Q  Now,    you  mentioned  the  Washington  Post 

earlier.      Is  there  any  evidence  here  that  PFC  Manning 
also  visited  a  Washington  site  associated  with  the 
Washington  Post? 

A  Yes,  18. 

Q  How  do  you  know  that? 

A  WWW . WashingtonPost . com . 

Q  Thank  you. 

MAJOR  FEIN:      Thank  you,    Your  Honor  United 
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States  moves  to  admit  Prosecution  Exhibit  192  for 
identification,    Prosecution  Exhibit  192 . 

MR.   TOOMAN:     No  objection. 
THE  COURT:      Let  me  see  it. 
Prosecution  Exhibit  192  for 
identification  is  admitted. 

BY  MAJOR  FEIN: 

Q  Special  Agent  Shaver,    a  moment  ago  before 

the  favorcons  database  you  testified  that  you  found 
evidence  of  Wikileaks  Twitter  feed  in  both  the 
unallocated  space  and  the  allocated.     What  evidence  did 
you  find  in  general  in  the  unallocated  space? 

A  Several  unique  URLs  to  specific  Twitter 

tweets  pertaining  to  Wikileaks . 

Q  What  did  you  do  when  you  found  these? 

A  I  went  to  computer,   to  a  NIPRnet  computer. 

I  wanted  to  see  were  these  valid  tweets,  and  so  I  went 
to  the  web  page  and  pulled  that  URL  up  and  put  that  up 
and  witnessed  the  results . 

Q  Special  Agent  Manning  I ' m  handing  you 

what's  been  marked  as  Prosecution  Exhibit  194A,    B,  C 
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would  you  look  at  those  and  let  me  know  when  you ' re 
finished. 

A  (Witness  reviewing  document.) 

Q  Do  you  recognize  those  three  documents? 

A  I  do. 

Q  What  are  those? 

A  These  are  in  case  reports  concerning  the 

mentioned  tweets  concerning  Twitter.com  from  the 
unallocated  space  of  PFC  Manning's  personal  Macintosh 
computer . 

Q  Are  all  —  how  did  you  —  are  those 

documents  you  created? 
A  They  are . 

Q  How  did  you  create  those? 

A  From  EnCase  I  created  a  report  based  upon 

the  findings . 

Q  Is  that  the  report  for  all  three  of  them? 

A  It  is. 

Q  And  is  there  any  difference  what  are  the 

differences  between  those  three  pages? 

A  Two  of  three  are  actual  direct  URLs  into  a 
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specific  Twitter  on  Wikileaks .      The  third  one  is  a 
search  of  Twitter . com  key  word  Wikileaks . 

Q  You  said  I  think  URL  for  Twitter  on 

Wikileaks .     What  do  you  mean? 

A  The  address  is  Twitter.com/Wikileaks/status 

and  a  unique  number . 

MAJOR  FEIN:     Permission  to  publish,  Your 

Honor . 

THE  COURT:      Go  ahead. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    I'm  publishing 

Prosecution  Exhibit  194  Bravo  and  Charlie.  You 
mentioned  there's  two  different  types  of  the 
unallocated  space  information  you  found.     Which  one  is 
this? 

A  These  are  actual  URLs  to  a  tweet  that  was 

recovered  that  found  in  the  unallocated  space  of  the 
personal  Macintosh  computer . 

Q  How  do  you  know  that  each  of  those  URLs  are 

tweets? 

A  I  put  that  address  into  a  web  browser  and  I 
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went  into  the  tweet  itself. 

Q  Did  those  two  addresses  when  you  put  into  a 

web  browser  pull  up  a  tweet? 

A  They  did . 

Q  Different  tweets? 

A  Yes . 

Q  Now,   was  the  address  that  came  up  with  the 

web  browser  identical  to  the  address  on  these  two 
documents? 

A  No. 

Q  What  was  different? 

A  The  difference  was,   you  should  see,  it's 

site  HTTP,//     twitter  is  now  on  HTTPs : // . 

Q  Was  everything  after  the  HTTPS  the  same 

when  you  went  to  Twitter? 

A  Yes . 

Q  When  did  you  go  on  Twitter? 

A  Past  couple  of  days . 

Q  I'm  now  overlaying  Prosecution  Exhibit  194 

Alpha  and  whats  this  portion  that  you  recovered  from 
the  unallocated  space  the  search  on  Twitter . com  and  key 
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word  was  Wikileaks . 

How  do  you  know  the  key  word  was  Wikileaks? 
A  The  Q  equals  is  the  search. 

Q  And  what  else,   what  other  information  does 

this  cover  unallocated  space  tell  you? 

A  Off  to  the  right  there  was  another  tweet 

identifier  with  the  numbers  125  off  to  the  right. 

Q  What ' s  the  whole  number  please . 

A  It's  2558544922. 

Q  How  do  you  know  that  you  call  that  a  unique 

identifier,   how  do  you  know  that? 

A  I  put  that  into  again  I  went  to  Twitter  and 

put  that  in  as  a  identifier  with  the  other  two  and  a 
tweet  concerning  Wikileaks  was  there . 

Q  Now,    you  said  like  the  other  two.  Earlier 

you  testified  that  you  basically  copied  and  pasted  the 
HTTP : twitter/ /twitter . com  that  whole  thing  in  there. 
Did  you  copy  and  paste  this  from  Prosecution  Exhibit 
194  Alpha  into  Twitter? 

A  No.      I   just  used  the  unique  identifier. 

Q  What  else  did  you  combine  with  that  unique 
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identifier? 

A  The  HTPS  Twitter . com  Wikileaks  status . 

Q  What  occurred  when  you  put  that  into  the 

Internet  explore? 

A  A  tweet  concerning  Wikileaks . 

Q  And  did  you  use  Internet  Explorer  or 

Firef ox . 

A  Internet  Explorer . 

Q  And  then  what  did  you  do  once  you  put  those 

into  a  NIPRnet  computer  and  brought  up  the  tweets? 

A  I  printed  them. 

MAJOR  FEIN:        Your  Honor,   United  States  is 
handing  Special  Agent  Shaver  Prosecution  Exhibit  193 
Alpha  through  Charlie  for  identification  and  pulling 
off  the  projector  the  three  exhibits,    194  Alpha  through 
Charlie . 

BY  MAJOR  FEIN: 
Q  Do  you  recognize  this  document? 

A  Yes. 

Q  What  are  those  documents? 

A  These  are  the  screen  shots  I  created. 
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Q  How  do  you  recognize  those? 

A  My  initials  are  on  them. 

Q  Do  you  recognize  the  contents  as  well? 

A  Yes . 

Q  Earlier  you  testified  that  you  used 

Microsoft  Internet  Explorer.     What  browser  did  you  use? 
A  Firefox. 
Q  How  do  you  know  that? 

A  The  Firefox  tab  is  present . 

Q  And  when  you  printed  those  —  or  what  else 

do  you  recognize  on  that  page? 

A  The  background  is  the  Wikileaks  logo . 

Q  How  do  you  know  that? 

A  I've  seen  it  throughout  this  investigation. 

MAJOR  FEIN:      I'm  going  to  retrieve  from  you 
those  exhibits. 

Permission  to  publish. 
THE  COURT :     Yes . 
BY  MAJOR  FEIN: 
Q  So  Special  Agent  Shaver,    I'm  going  to 

publish  194  and  portions  of  194  also.      So  this  is 
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Prosecution  Exhibit  194  Alpha  for  identification  and 
here  is  the  tweet  that  is  Prosecution  Exhibit  193  Alpha 
for  identification. 

How  do  these  two  documents  relate  to  each 

other? 

A  They're  the  same  unique  identifier. 

Q  How  do  you  know  that? 

A  Because  I  copied  that  unique  identifier 

into  the  browser  and  I  hit  enter . 
Q  When  you  say  that  — 

A  I'm  sorry.     Off  to  the  right  you  see  the 

number  125. 

Q  Which  is  unallocated  space  or  is  it  the 

tweet? 

A  In  the  unallocated  space .      It  says 

12558544922 . 

Q  Yes . 

A  I  copied  and  pasted  that  into  the  Wikileaks 

status  URL  and  this  is  what  arrived,    this  is  what  was 
there . 

MAJOR  FEIN:     Your  Honor,    United  States 
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moves  to  admit  Prosecution  Exhibit  194  Alpha  and  193 
Alpha  for  identification  as  both  194  Alpha  and  193 
Alpha . 

MR.   TOOMAN:     We  do  object,    Your  Honor.  The 
Court  has  said  it  is  relevant  those  things  that 
informed  PFC  Manning's  understanding  of  Wikileaks . 

This  witness  hasn't  testified  PFC 
Manning  actually  saw  those  tweets .     All  he  said  was 
there  were  links  to  those  tweets  on  his  computer. 

THE  COURT :     You  can  argue  that  when  you  do 
your  closing  argument.      The  inference  could  be  there. 

Any  other  objection? 

MR.   TOOMAN:     No,  ma'am. 

THE  COURT:     May  I  see  it. 

MR.   TOOMAN:     Objection  is  overruled. 

THE  COURT :     Yes . 

MAJOR  FEIN:     Your  permission  to  publish  193 
and  194  Bravo. 

THE  WITNESS:      Go  ahead. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    similarly  how  do 
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these  two  documents  relate  to  each  other? 

A  In  the  unallocated  portion,   the  top  you  can 

see  that  address,   the  status,   and  that  unique 
identifier.      I  pasted,    I  put  that  to  the  —  I  went  to 
Twitter.com  and  put  that  same  exactly  address  in  and 
what  appeared  was  the  one  below. 

MAJOR  FEIN:     United  States  moves  to  admit 
194  Bravo  and  193  Bravo. 

MR.   TOOMAN:  Object. 

THE  COURT :     Overruled . 

MAJOR  FEIN:        Your  Honor,   permission  to 
publish  194  Charlie  and  193  Charlie. 

THE  COURT:      Go  ahead. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    how  are  those  two 

documents  related? 

MR.   TOOMAN:     Assuming  our  objection  will  be 

overruled . 

MAJOR  FEIN:     United  States  moves  to  admit 
Prosecution  193  Charlie  and  194  Charlie  for 
identification  as  193  Charlie  and  194  Charlie. 
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THE  COURT:     Defense,    just  for  the  record, 
your  objection  is  overruled.      I  understand  you  made  the 
same  objection. 

MR.   TOOMAN:      Thank  you,    Your  Honor. 
THE  COURT:     Prosecution  exhibits  193 
Charlie  and  194  Charlie  are  admitted. 
BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver,    in  reference  to  our 

searches  for  Twitter  on  PFC  Manning's  personal 
Macintosh,   why  did  you  or  your  office  not  search  for 
Twitter  related  information  prior  to  the  past  few  days? 
A  We  didn ' t  know  it  was  important . 

Q  What  do  you  mean  by  that? 

A  The  focus  of  the  original  exam  was  to  find 

government  data,    State  Department  data.     So  documents, 
things  along  that  nature,    Guantanamo  Bay. 

Q  Now,    I ' d  like  to  focus  your  testimony  on  a 

specific  e-mail  that  you  pulled  as  part  of  the  forensic 
exam  in  the  last  few  days . 

Over  or  the  past  week  did  the  prosecution 
ask  you  to  search  PFC  Manning's  computer  to  any  e-mails 
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related  to  the  New  York  Times? 
A  I  did. 

Q  What  did  you  find? 

A  I  found  one  message. 

Q  How  did  you  find  it? 

A  PFC  Manning's  computer  was  configured  to 

use . 

Q  I'm  sorry,   what  computer? 

A  PFC  Manning's  personal  computer. 

MR.   TOOMAN:     Before  we  go  further,  the 
substance  of  this  e-mail  doesn't  invoke  Wikileaks  at 
all.      There's  no  explicit  reference  to  Wikileaks,  it 
doesn't  discuss  PFC  Manning's  views  on  Wikileaks. 

An  e-mail  to  the  New  York  times,    in  our 
view,    doesn't  have  any  bearing  on  whether  or  not 
Wikileaks  is  a  journalistic  organization. 

THE  COURT :     Do  you  want  to  see  the  e-mail . 

(INAUDIBLE) . 

MAJOR  FEIN:     May  I  have  a  moment,  Your 

Honor . 

THE  COURT :     Yes . 
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MAJOR  FEIN:     Your  Honor,    although  there 
are  two  documents  the  United  States  intends  to  use 
they're  identical  except  for  the  way  the  message  was 
pulled.      I'm  handing  you  what's  been  marked  as 
Prosecution  Exhibit  195  Bravo  for  objection. 

THE  COURT:     What's  the  point  of  this? 

MAJOR  FEIN:        Your  Honor,   United  States  is 
offering  this  e-mail  to  rebut  the  inference  that  PFC 
Manning  thought  Wikileaks  was  a  legitimate  news 
organization  because  this  e-mail  shows  that  if  he  had 
identified  something  that  was  news  worthy  he  would  have 
actually  gone  and  he  tried  to  go  or  to  the  New  York 
Times . 

So  if  the  defense  is  arguing  what  PFC 
Manning  did  or  didn't  know,    then  this  would  be 
equally  permissible  inference  that  he  knew  what 
legitimate  was  and  that's  not  what  he  used  it  for, 
and  also  note  the  date,   Your  Honor,   dated  April  8th 
which  the  United  States  will  argue,    if  it's 
admitted,   which  was  just  a  few  days  after  the  public 
release  of  the  Apache  video  and  then  contacted  the 
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New  York  Times  about  it . 

THE  COURT:     Why  is  it  in  the  rebuttal  case? 

MAJOR  FEIN:     Because  the  defense  is  —  the 
defense  offered  the  idea  that  PFC  Manning  would  know 
what  legitimate  press  was  through  Professor  Bangler  and 
once  they  offered  that,   Your  Honor,   the  United  States 
is  rebutting  if  that ' s  going  to  be  the  inference . 

They  argue  that  in  rebuttal  that  he  knew 
what  it  actually  was  and  not  Wikileaks  and  his 
actions  are  not  consistent  with  that  argument  but 
until  the  defense  makes  that  argument  United  States 
would  offer  it's  not  even  relevant  for  that  reason. 

THE  COURT:      I  don't  see  the  connection. 
I'm  going  to  sustain  the  objection  on  this  one. 

MAJOR  FEIN:     Yes,   ma'am.     May  I  have  a 
moment,    Your  Honor? 

THE  COURT :     Yes . 

BY  MAJOR  FEIN: 
Q  Now  I ' d  like  to  direct  your  testimony  to  a 

SigAct,    a  specific  SigAct .     Over  the  past  week  did  the 
prosecution  ask  you  to  search  PFC  Manning's  personal 
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computer  for  information  related  to  an  Iraqi  publishing 
concerning  propaganda  in  2010? 
A  Yes . 

Q  And  what  did  you  find? 

A  Within  the  unallocated  space  of  PFC 

Manning's  personal  computer  personal  Macintosh,  there 
was  a  deleted  SigAct . 

Q  How  did  you  find  that  SigAct? 

A  Based  off  of  examination  of  text  file  I  was 

able  to  —  I  looked  down  and  I  was  told  the  SigAct 
involved  a  printing  organization,    a  printing,    and  some 
people  were  arrested.     Based  off  volumes. text  there  was 
text  files  saying  arrests . 

Things  along  that  nature,    and  based  in  that 
same  —  on  that  same  CD  that  was  burned  was  a  appeared 
to  be  a  CIDNE  key,    a  CIDNE  tracking  key,    and  I  searched 
for  that . 

MAJOR  FEIN:     Your  Honor,   permission  to 
public  Prosecution  Exhibit  127 . 

THE  COURT:      Go  ahead. 
BY  MAJOR  FEIN: 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 

151 

Q  Special  Agent  Shaver,    do  you  recognize  this 

document? 

A  I  do. 

Q  What  is  it? 

A  It  is  a  volume  subtext . 

Q  And  very  quickly  and  generally  what  does 

this  reflect? 

A  This  is  the  CD  volumes  that  had  been 

accesses  and  recovered  from  the  unallocated  space  of 
PFC  Manning's  machining  personal  computer. 

Q  What  do  you  mean  by  volume? 

A  A  column  is  volume  is  a  CD  in  this  case . 

It's  just  mounted. 

Q  What  is  the  numbers  after  volume  slash  and 

then  there's  numbers? 

A  That's  a  date,    time  donation.      So,  for 

example,    line  18  is  March  4th,    2010,    at  2258  hours, 
that  was  burned . 

Q  And  then  what ' s  the  last  part  of  that ,  what 

does  that  denote? 

A  Line  18 . 
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Q 


Sure . 


A 


That  appeared  to  me  to  be  a  CIDNE  report 


key . 


Q 


But  in  general  what  is  it? 


A 


Those  are  the  files  on  a  CD. 


Q 


So  what  did  you  do  with  volume . txt  in  order 


to  find  this  SigAct? 


A 


I  looked  at  that  —  I  saw  —  I  remember 


seeing  the  propaganda  arrest  notes .      I  thought  that 
might  have  something  to  do  with  it,    and,    again,  I 
noticed  what  appeared  to  be  a  CIDNE  tracking  key  which 
is  line  18 . 


search,  of  the  unallocated  space,  and  I  was  able  to 
locate  the  document  in  question. 


Manning ' s  personal  Macintosh  computer . 

I  now  want  to  hand  you  what ' s  been  marked 
as  Prosecution  Exhibit  196  for  identification,   but  I'm 
going  to  move  this  cover  in  front  of  you.      I'm  handing 
you  Prosecution  Exhibit  196. 


I  then  used  that  as  a  search,   a  key  word 


Q 


What  computer  did  you  located  it  on.  PFC 
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Will  you  please  keep  it  and  look  up  and 
you're  finished. 

A  Yes,  sir. 

Q  What  is  that? 

A  This  is  the  recovered  SigAct  that  I  spoke 

of. 

Q  And  how  do  you  recognize  it? 

A  This  is  an  EnCase  report  of  that .      This  is 

something  I  created  and  my  initials  are  on  it . 
Q  And  where  was  it  located? 

A  The  unallocated  space  of  PFC  Manning ' s 

personal  Macintosh  computer . 

MAJOR  FEIN:        Your  Honor,   United  States 
moves  to  admit  Prosecution  Exhibit  196  for 
identification  as  Prosecution  Exhibit  196. 

MR.   TOOMAN:     No  objection. 
THE  COURT:     May  I  see  it,  please? 
Prosecution  Exhibit  196  for  identification  is  admitted. 

MAJOR  FEIN:      Thank  you,    Special  Agent 
Shaver.     No  further  questions. 

THE  COURT:  Defense? 
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CROSS  EXAMINATION  BY  MR.    TOOMAN : 
BY  MR.  TOOMAN: 
Q  We  meet  again,    Special  Agent  Shaver. 

A  Yes,  sir. 

Q  Let's  start  off  by  talking  about  WGet? 

A  Yes,  sir. 

Q  I'd  like  to  retrieve  Prosecution 

Exhibit~100,  please. 

MR.   TOOMAN:     Ma'am,   permission  to  publish. 
THE  COURT :     Yes . 
BY  MR.  TOOMAN: 
Q  Agent  Shaver,   what  we  see  on  Prosecution 

100  are  essentially  the  links  to  the  NCD  database, 
correct? 

A  Yes . 

Q  And  it ' s  one  —  if  one  wanted  to  go  view 

we'll  look  at  the  very  top  line  here  line  10926.  If 
one  wanted  to  view  that  10  canbara  153  cable  what  would 
they  put  into  their  machine? 

A  You  would  start  from  where  it  says  HTTP  and 

would  you  copy  that  all  the  way  through  153  and  put 
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that  in  the  web  browser . 

Q  Showing  you  Prosecution  Exhibit  187. 

MR.   TOOMAN:     Permission  to  publish,  ma'am. 
THE  COURT :     Yes . 
BY  MR.  TOOMAN: 
Q  When  you  talked  on  direct  you  talked  about 

the  process  through  which  one  would  get  cables  from  the 
NCD,  right? 

A  Yes . 

Q  One  of  the  ways  of  what  you  talked  about 

was  someone  going  to  the  web  page,    so  basically  the  NCD 
home  page? 

A  Yes . 

Q  And  once  they  got  to  the  NCD  home  page  they 

could  do  a  search? 
A  Yes . 

Q  Once  they  did  a  search  they  might  see  a 

number  of  links  come  up,  correct? 
A  Correct . 

Q  And  they  could  click  on  that  link,  correct? 

A  Yes . 
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Q  And  then  that  link  would  take  them  to  a 

page? 

A  Sure . 

Q  Perhaps  that  cambera  table  cable  we  just 

talked  about? 

A  Yes . 

Q  If  the  person  new  the  URL  for  that  cambera 

cable  they  could  just  type  that  directly  into  their 
browser,   wouldn't  they? 

A  Correct . 

Q  So  a  user  doesn ' t  have  to  go  to  the  home 

page,   the  NCD  home  page,    in  order  to  access  a  cable? 
A  Correct . 

Q  So  if  you  just  talked  about  that  URL  and  if 

I  just  typed  that  in  as  a  web  browser  I ' d  go  to  that 
cambera  page? 

A  You  would. 

Q  So  I  don't  have  to  go  to  that  home  page,  in 

other  words,   to  get  that  to  cambera  cable? 
A  Correct . 

Q  And  the  naming  convention  for  Department  of 
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State  cables  is  the  same  for  those  web  pages  the  same 
for  every  one,   NCD  up  to  the  MRN? 
A  Yes . 

Q  And  then  you  put  in  the  MRN . HTML  and  you 

get  to  the  cable? 

A  Correct . 

Q  Now,   you  talked  about  the  process  through 

which  PFC  Manning  got  these  cables  and  you  said  that 
what  he  did  was  he  went  to  the  home  page,  he  went  to 
the  NCD  home  page;    is  that  correct? 

A  Yes . 

Q  And  did  search  to  find  the  most  recent 

cables? 

A  Yes. 

Q  And  he  copied  that? 

A  I'm  assuming  on  that  one.      I'm  assuming. 

Q  So  he  would  have  done  a  copy  control  C  and 

pasted  it  into  Excel? 
A  Correct . 

Q  And  that  Excel  document  is  what  you  used  in 

order  to  help  him  write  whatever  script  used  for  WGet? 
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A  Right . 

Q  You  testified  on  direct  —  I'm  going  to 

flip  over  here  to  page  2  and  publish  that .     WGet  can 
just  go  directly  to  the  server? 

A  Correct . 

Q  But  it's  also  possible  —  I'm  on  putting 

page  one  back  up  —  that  a  user  could  go  to  the  home 
page,   copy,   paste,   or  they  could  go  to  the  home  page 
and  do  the  search  and  pull  up  the  cables .     They  can 
have  the  home  page  up.     They  could  copy  that 
information,   put  it  into  their  Excel,  correct? 

A  Yes. 

Q  Put  it  into  WGet  and  while  the  web  browser 

is  still  open  run  WGet,  correct? 
A  Correct . 

Q  And  there ' s  no  evidence  to  suggest  that  PFC 

Manning  didn't  do  that,    correct?     You  can't  say  that  he 
didn ' t  have  the  NCD  database  open  when  he  was  running 
WGet? 

A  That ' s  correct . 

MR.   TOOMAN:     Removing  Prosecution 
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Exhibit  187 . 

THE  COURT:      Let  me  stop  you  for  just  a 
minute .      That  was  fast .     Explain  to  me  what  path  you 
just  described  for  WGet  once  again. 

MR.   TOOMAN:     You  want  me  to  go  through  the 
questions  again? 

THE  COURT :     Yes . 

BY  MR.  TOOMAN: 
Q  Now,    I'll  retrieve  Prosecution  Exhibit  187 

and  publish. 

THE  COURT :     Yes . 

BY  MR.  TOOMAN: 
Q  Now,   you  talked  about  the  process  through 

which  PFC  Manning  got  MRNs,  correct? 
A  Correct . 

Q  And  the  process  was  going  to  NCD  home  page? 

A  Yes . 

Q  Do  a  search  for  the  most  recent? 

A  Yes . 

Q  Find  out  what  those  are? 

A  Yes . 
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Q  At  that  point  they're  on  the  screen? 

A  Yes . 

Q  There's  a  list  of  MRNs  on  the  screen, 

correct? 

A  Yes . 

Q  Highlight  them? 

A  Yes . 

Q  Copy  them? 

A  Yes . 

Q  Paste  them  into  Excel? 

A  Correct . 

Q  Then  using  Excel  PFC  Manning  would  have 

written  whatever  script  he  was  going  to  use  in  WGet? 
A  Correct . 

Q  And  then  WGet  would  have  ran  and  done  its 

thing  and  got  the  cables? 
A  Correct . 

Q  When  that  was  happening  the  NCD  home  page 

could  have  been  open? 
A  Yes . 

Q  And  there's  no  evidence  in  your  analysis  of 
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PFC  Manning ' s  Mac  computer  to  suggest  that  he  didn ' t 
have  the  NCD  home  page  open  when  he  ran  WGet? 

A  Sir,    do  you  the  mean  .22? 

Q  Yes.     Thank  you,   the  .22. 

So  there's  no  evidence  on  the    .22  machine 
that  when  PFC  Manning  wag  running  WGet  the  NCD  home 
page  wasn't  open? 

A  Correct,   because  Internet  history  was  set 

to  be  cleared. 

Q  So  it ' s  quite  possible  that  PFC  Manning  did 

the  copy,  had  NCD  open,  pasted  it  into  Excel,  got  it 
into  WGet  and  ran  WGet  while  he  was  still  on  the  NCD 
home  page? 

A  Correct . 

Q  Or  on  the  NCD  search  results? 

A  Yes . 

MR.   TOOMAN:     Removing  Prosecution 
Exhibit  187  for  Prosecution  Exhibit  187  returning  it  to 
the  court  reporter . 

BY  MR.  TOOMAN: 
Q  Now,    you  talked  briefly  on  direct  about 
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something  called  HBSS,   was  does  that  stand  for? 

A  Post  based  security  system. 

Q  And  you  said  on  direct  that  HBSS  had  the 

ability  to  prevent  the  user  from  running  an  executable 
file? 

A  Yes . 

Q  A  self-executable  file  could  have  been 

prevented  by  HBSS? 
A  Yes. 

Q  And  you  also  said  that  HBSS  was  in  the 

possession  of  the  Army  at  the  time  all  of  this 
happened? 

A  Yes . 

Q  The  Army  had  it? 

A  Yes . 

Q  And  the  Army  could  have  put  on  it  all  the 

systems,   it  was  software  we  had? 
A  Yes . 

Q  And  if  the  Army  had  wanted  to  they  could 

have  set  it  up  so  a  user  couldn't  run  a  self-executable 
file? 
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A  Correct . 

Q  Understand  the  Army  didn't  do  that? 

A  Not  to  my  knowledge . 

Q  I  would  like  to  retrieve  prosecution 


Exhibit  188,  please. 

MR.   TOOMAN:     Permission  to  publish. 
THE  COURT:      Go  ahead. 
BY  MR.  TOOMAN: 
Q  Special  Agent  Shaver,    this  is  Prosecution 

188  and  these  prefetch  files? 
A  Correct . 

Q  And  what  the  prefetch  files  tells  us  is 

that  basically  their  program  was  run? 
A  Yes . 

Q  And  we  see  in  I  guess  the  fourth  column  we 

see  the  date  that  it  was  last  burned? 
A  Correct . 

Q  Now,   what  we  don't  know  from  the  prefetch 

files  how  long  the  program  ran,  correct? 

A  That's  not  quite  right,  sir. 

Q  Can  you  tell  from  the  prefetch  files  if  the 
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program  ran  for  30  seconds  or  it  ran  for  a  minute? 

A  I  can  tell  from  the  prefetch  that  they ' ve 

got  —  they  ran,    how  many  times  it  ran.      So  in  the  case 
of  the  last  one  bloop,   number  20,   excuse  me,    it  was 
only  run  one  time.     So  you  have  a  date  it  was  created, 
was  that  time,   and  the  date  it  was  last  run  would  be 
the  ending  time.      In  that  case,  yes. 

Q  You  can  tell  how  long  this  one  ran? 

A  It  only  ran  one  time . 

Q  Now,   when  number  20,    so  we  see  it  started 

at  2010  on  3  May  and  it  ran  until  02  of  May  4,  right? 
A  Yes . 

Q  There  are  no  other  instances  of  WGet 

running  at  that  time,  correct? 
A  Correct . 

Q  And  so  let ' s   just  look  at  number  one .  When 

it  ran  on  1  April  at  12:21    '08  8  you  don't  know  how 
long  it  ran,    do  you? 

A  Correct . 

Q  So  you  don ' t  know  if  while  it  was  running 

there  was  another  instance  of  it  running? 
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A  I  mean,   the  dates  and  times  on  the  files 

were  created.      If  you  look  at  first  line.     Again,    go  to 
the  first  created  date.     The  created  time  is  13:48:34 
followed  by  13  on  the  next  line  is  13:48:40.     That's  a 
few  seconds  apart,   and  you  continue  going  down  they're 
there ' s  seconds  apart  from  each  other . 

Q  But  it's  possible  that  that  ran  for  five 

seconds? 

A  It  is  possible. 

Q  And  then  the  next  one  opened  up  4  0  and  that 

ran  until  4844,    and  the  third  one  opened  up? 
A  It  is  possible. 

MR.   TOOMAN:     Removing  Prosecution 

Exhibit  188. 

Retrieving  publication  189.  Permission 
to  publish,   Your  Honor. 

THE  COURT:      Go  ahead.     You  can  publish 
anything  that's  been  admitted. 

MR .   TOOMAN :      Thank  you ,   ma ' am . 

BY  MR.  TOOMAN: 
Q  Prosecution  Exhibit  189  basically  the  help 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


166 

file  or  introductions  on  different  things  you  can  do 
with  WGet,  correct? 

A  Correct . 

Q  Now,    I  want  to  direct  your  attention  down 

to  the  last  section  there  HTTP  options? 
A  Okay . 

Q  Now,    if  we  look  under  there  you  would  say 

that  it  was  possible  that  WGet  —  to  set  WGet  up  so 
that  if  you  are  accessing  or  if  you  were  going  to  a 
website  that  required  a  password  and  a  user  name  you 
could  set  WGet  up  to  provide  that  password  and  user 
name? 

A  Correct . 

Q  And  so  if  on  the  NCD  database  a  user  needed 

to  put  in  a  user  name  and  a  password  to  get  access  you 
could  have  done  that  on  WGet? 

A  Correct . 

Q  Now,   you  talked  about  certain  batch  files 

or  the  script  that  was  run  by  PFC  Manning  on  the  .22 
machine .     You  didn ' t  see  anything  where  there  was  a 
user  name  or  password  included  in  the  scripts,  correct? 
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A  Correct . 

Q  And  why  wouldn ' t  there  have  been  a  user 

name  or  password  in  the  scripts? 
A  It's  not  required. 

MR.   TOOMAN:     Removing  Prosecution 

Exhibit  189. 

BY  MR.  TOOMAN: 

Q  So  it  wasn ' t  required  because  once  an 

individual  logged  on  to  their  SIPRnet  machine  they  had 
access  to  the    (INAUDIBLE) . 

A  Correct . 

Q  They  didn ' t  have  to  put  any  other 

information  in  their  computer  at  any  time  to  get 
(INAUDIBLE) ? 

A  Correct . 

MR.   TOOMAN:      If  we  could  retrieve 
Prosecution  Exhibit  191. 

BY  MR.  TOOMAN: 

Q  Special  Agent  Shaver,   you  testified  about  a 

number  of  batch  files . 

A  Correct . 
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Q  I'd  like  to  talk  about  little  bit  more 

about  what  batch  file  as .     Within  a  batch  file  there 
are  a  series  of  commands,  correct? 

A  Correct . 

Q  There's  multiple  lines  within  the  batch 

file? 

A  Yes . 

Q  And  each  one  of  those  lines  is  a  command  or 

an  introduction? 

A  Correct . 

Q  So  let's  just  look  at  I  up  there,   or  let's 

actually  look  at  E,   echo.     Within  that  bat  file  there 
were  a  number  of  introductions  or  commands? 

A  Okay . 

Q  Is  that  — 

A  There  could  be . 

Q  Well,   that's  what  a  batch  file  is,  right? 

A  Yes . 

Q  What  would  you  expect  to  see  in  there  since 

these  were  the  batch  files  used  to  get  the  cables  you 
would  expect  to  see  that  WGet  introduction  in  there, 
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correct? 

A  Correct . 

Q  And  you  would  expect  to  see  each  line  would 

be  a  different  instruction? 
A  Yes . 

Q  So  the  first  line  might  be  to  get  using 

MRNs  that  we're  just  going  to  make  up  09  Vienna  1. 
That  would  be  the  first  cable  from  Vienna  in  2009  and 
the  next  line  would  be  09  Vienna  2,  possibly? 

A  Sure . 

Q  One  actually  ran  the  bat  file  what  would 

happen  is  WGet  would  go  and  then  get  09  Vienna,  right? 
A  Yes . 

Q  And  then  after  it  got  509  Vienna  1  would  it 

go  back  and  get  09  Vienna  2  because  that  was  the  next 
line  and  it  would  go  through  until  all  of  the 
instructions  were  done? 

A  Yes . 

Q  And  it  would  do  them  one  at  a  time? 

A  Yes . 

Q  That's  why  when  you  testified  on  the  merits 
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you  talked  about  firewall,  right? 
A  Yes. 

Q  DOS  firewalls .      There  are  hundreds  of 

thousands  of  connections? 
A  Correct . 

Q  Between  the  22  machine  and  the  40  machine 

and  Department  of  State,  and  the  reason  there  were  so 
many  connections  was  because  these  were  coming  in  one 
at  a  time? 

A  Yes . 

Q  When  those  batch  files  run  it ' s  not 

downloading  two  or  three  cables  at  a  time? 

A  It's  doing  the  first  command  completing  it 

and  then  the  second  command . 

Q  Now,    I   just  want  to  talk  sort  of  generally 

about  the  big  picture  about  WGet .     WGet  is  a  program 
that ' s  in  open  source? 

A  Correct . 

Q  And  it ' s  not  a  program  that ' s  known  for 

being  synonymous  with  hackers,  correct? 
A  It  could  be . 
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Q  It  could  be,   but  it's  not  necessarily? 

A  Correct . 

Q  It ' s  used  for  purposes  by  a  lot  of 

different  people? 
A  Yes . 

Q  And  a  lot  of  those  people  aren't  hackers? 

A  Yes. 

MR.   TOOMAN:      Can  I  have  a  moment,  Your 

Honor? 

THE  COURT :     Yes . 
BY  MR.  TOOMAN: 
Q  Special  Agent,    I  want  to  talk  now  about  the 

tweets.     Before  we  go  to  the  tweets,    I  want  to  talk 
about  the  f abacons .      I  can  retrieve  Prosecution  Exhibit 
192.      I'm  removing  prosecution  191.     Publishing  192. 

You  talked  about  finding  these  in  the 
allocated  space? 

A  Correct . 

Q  And  generally  speaking  the  allocated  space 

are  the  nondeleted  things? 
A  Correct . 
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Q  And  when  we  talked  yesterday  you  told  me 

that  it's  possible  to  have  a  fabacon  on  your  computer 
without  ever  having  visited  the  site? 

A  No,  sir. 

Q  But  even  if  there  was  a  fabacon  present  on 

the  computer,   you  don't  know  if  the  person  actually 
visited  the  site  actually  saw  it? 

A  That ' s  part  of  the  code  actually  of  HTML . 

I  would  have  to  say,   no,  sir. 

Q  So  it ' s  possible  that  there  are  times  when 

you ' re  reading  something  in  the  news  and  you  click  on  a 
clinic  link  and  the  link  opens  up  in  a  new  tab,  right? 

A  Yes,  sir. 

Q  And  then  you  just  forgot  about  it,  you 

forgot  that  it's  there? 
A  Yes,  sir. 

Q  You  close  your  browser,    it's  gone? 

A  Yes,  sir. 

Q  You  never  saw  that  article? 

A  Correct . 

Q  That  article  is  open  on  your  computer 
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right? 

A  Yes,  sir. 

Q  And  if  that  article  on  that  website  had  had 

a  fabacon  that  would  be  in  your  allocated  space? 
A  It  would  be . 

Q  But  you  didn't  actually  see  the  article? 

A  That ' s  correct . 

Q  And  while  there  are  these  fabacons  you 

don ' t  actually  know  if  it  was  viewed  you  can ' t  say  when 
it  was  viewed? 

A  Correct . 

MR.   TOOMAN:     Removing  Prosecution  Exhibit 

182  . 

BY  MR.  TOOMAN: 
Q  Let ' s  talk  about  the  tweets .     Now  the 

tweets  again  you  found  URLs,  correct? 
A  Correct . 

Q  In  the  unallocated  space? 

A  Yes. 

Q  Now,   when  you  searched  the  unallocated 

space  for  Twitter? 
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A  Yes . 

Q  You  found  I  think  11  instances  of  Twitter 

in  the  unallocated  space? 

A  Twitter  and  Wikileaks . 

Q  Okay .     And  I  want  to  just  talk  about  the 

instances  of  Twitter.  Okay? 
A  Okay . 

Q  You  didn't  find  —  well,   actually  all  you 

found  related  to  Twitter  in  the  unallocated  space  were 
those  URLs,  correct? 

A  Correct . 

Q  When  you  searched  the  unallocated  space 

both  previously,   years  ago,   and  then  most  recently  this 
week  or  last  week  you  recovered  a  number  of  web  pages, 
right? 

A  Correct . 

Q  And  none  of  those  web  pages  were 

Twitter.com,  correct? 

A  I  do  not  recall  them  being  Twitter . 

Q  So  when  you  find  these  instances  of  Twitter 

that  we  talked  about  today,    it's  the  URL,  right? 
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A  Correct . 

Q  But  there ' s  not  actually  evidence  that  URL 

was  pull  up  on  the  computer? 

A  Correct . 

MR.   TOOMAN:      I'd  like  to  retrieve  Defense 
Exhibit  igloo  igloo . 

BY  MR.  TOOMAN: 

Q  I'm  handing  you  India  India  for 

identification . 

A  Thank  you,  sir. 

Q  What  is  that? 

A  This  is  a  recovered  web  page  from  the 

unallocated  space.     This  web  page  has  my  initials  next 
to  it . 

Q  How  do  you  know  that's  what  it  is? 

A  Because  I  was  there  when  it  was  created. 

Q  How  did  you  find  or  how  was  this  article 

found? 

A  This  article  was  found  based  first 

identifying  the  location  of  the  two  tweets,   the  two 
tweets  that  I  spoke  of  earlier,   the  ones.     Those  were 
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embedded  in  this  web  page . 

MR.   TOOMAN:      I'd  like  to  retrieve  Exhibits 
194  Charlie  and  Bravo,  please. 

BY  MR.  TOOMAN: 
Q  Special  Agent  Shaver,    I've  published  194. 

Are  these  the  URLs  that  you  used  to  find  that  article? 
A  Correct . 

Q  Removing  194  Bravo  and  Charlie.  Retrieve 

Defense  Exhibit  India  India  for  identification. 
BY  MR.  TOOMAN: 

Q  Now,   Agent  Shaver,   why  did  this  article 

come  up  when  you  searched  the  unallocated  space  for 
those  URLs? 

A  Because  they ' re  embedded  links . 

Q  Where  in  this  article  do  you  recall  were 

those  links  embedded? 

A  I  don't  remember  which  link  went  to  which 

one  but,   approximately  from  the  bottom  to  the  top, 
starts  earlier  the  fourth  up,    the  link  file  from  the 
left,    earlier  Wikileaks  versus  Twitter. 

Basically  fourth  paragraph  up  Wikileaks 
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Twitter  feed.      That  is  one,    and  another  one  was  in  the 
paragraph  started  all  the  tweets  came  out  in  a  rush. 

Q  Agent  Shaver,    this  article  was  found  in  the 

unallocated  space  of  PFC  Manning's  Mac  computer, 
correct? 

A  Correct . 

Q  So  that  means  that  at  some  point  this 

article  was  pulled  up  on  his  computer? 
A  Yes . 

Q  You  don ' t  know  if  he  actually  clicked  on 

the  link  and  followed  it,  correct? 
A  Correct . 

Q  Because  we  don ' t  have  any  actual 

Twitter.com  web  pages? 
A  Correct . 

Q  I'd  like  to  have  you  read  —  actually  if 

you  could  just  read  the  third  paragraph? 
A  Starts  with  word  Assange? 

Q  Yes . 

A  Assange  was  traveling  to  speak  at  an 

investigative  journalism  conference  in  Norway  and  told 
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SBS  that,    quote,    U.S.    sources  told  Iceland  state  media 
that  the  U.S.   State  Department  was  aggressively 
investigating  a  leak  from  the  U.S.   embassy  in 
(INAUDIBLE),    end  quote. 

MR.  TOOMAN:  Removing  Defense  Exhibit  for 
identification  India  India  and  offering  it  as  Defense 
exhibit . 

THE  COURT:     Any  objection? 
MAJOR  FEIN:     No,  ma'am. 
THE  COURT:      It  is  admitted. 
BY  MR.  TOOMAN: 
Q  I'd  like  to  talk  now  about  the  other  tweet, 

the  third  tweet.     Retrieving  prosecution  Exhibit  193. 

Agent  Shaver,    this  tweet  includes  a  link, 

correct? 

A  Correct . 

Q  And  you've  gone  to  that  link,  correct? 

A  I  have . 

Q  And  that  link  offers  —  it ' s  an  article  on 

f aulker . com   ( INAUDIBLE ) ? 
A  Yes . 
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Q  And  it's  an  explanation  of  the  tweet,  it 

elaborates  on  it? 
A  Yes . 

Q  That  article  says  is  that  Facebook  deleted 

a  fan  an  unofficial  Wikileaks  page,  correct? 
A  Yes. 

Q  And  they  did  that  because  it ' s  their  policy 

that  they  don't  want  to  confuse  users  of  Facebook, 
right? 

A  Yes . 

Q  And  if  there's  an  unofficial  page  that  can 

be  confused  with  the  official  page,   they'll  take  down 
the  unofficial  page,   and  then  what  they  do  is  they 
migrate  the  user  from  the  unofficial  page  over  to  the 
official  page? 

A  Yes,  sir. 

MR.   TOOMAN:     Removing  prosecution  Exhibit 

193  Alpha. 

BY  MR.  TOOMAN: 
Q  Let ' s  talk  about  the  SigAct .  Okay? 

A  Yes,  sir. 
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Q  Now,    the  SigAct  you  found  reference  to  in 

the  value  mountain  data,  correct? 
A  Correct . 

Q  How  you  found  it  was  there  was  a  SigAct  of 

interest,  correct? 
A  Okay . 

Q  You  were  asked  to  find  something  — 

A  Yes . 

Q  —  referencing  or  related  to  a  particular 

SigAct? 

A  Correct . 

Q  And  when  you  looked  at  the  SigAct,  the 

actual  SigAct? 

A  Actually,  no. 

Q  You  were  given? 

A  Some  basic  information. 

Q  Basic  information  from  the  government? 

A  Yes . 

Q  One  of  the  pieces  of  information  you  were 

given  was  the  CIDNE  sort  of  the  identifying  number  of 


the  SigAct? 
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A  No.      I  was  basically  told  it  was  a  SigAct 

involving  press  printing  and  arrest  of  people . 

Q  And  so  you  did  some  key  word  searches  and 

you  found  part  of  these  SigAct s? 

A  Yes . 

Q  And  then  once  you  had  a  piece  of  that 

SigAct  up  that  SigAct  has  some  sort  of  identifying 
number  on  it? 

A  Yes. 

Q  And  then  you  took  that  identifying  number, 

right,    and  then  you  searched  PFC  Manning's  computer  for 
other  instances  of  that  identifying  number? 

A  I  did. 

Q  One  of  the  things  you  found  was  a  file  on  a 

CD  that  had  been  mounted  on  PFC  Manning ' s  computer? 
A  Correct . 

Q  So  basically  at  some  point  PFC  Manning  put 

a  CD  in  his  computer  and  on  that  CD  was  a  file  a . TXT 
file,  right? 

A  I  don ' t  know  the  extension . 

Q  There  was  a  file  and  the  name  of  that  file 
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was  the  same  as  the  ID  number  for  this  SigAct? 
A  Correct . 

Q  You  don't  know  if  that  file  was  actually 

the  SigAct? 

A  Correct . 

Q  But  it ' s  a  pretty  random  number  to  have 

been  anything  else? 

A  I  would  agree  with  you. 

Q  Now,    you  found  a  bunch  of  SigAct s  in  the 

course  of  your  investigation  over  all  the  different 
pieces  of  medium  associated  with  PFC  Manning,  correct? 

A  Yes . 

Q  PFC  Manning ' s  charged  with  taking  hundreds 

of  thousands  of  SigAct s  and  giving  them  to  Wikileaks 
and  you  found  all  of  those? 

A  Yes. 

Q  And  you  found  those  on  an  SD  card? 

A  Correct . 

Q  Could  you  tell  the  Court  how  those  were 

named  individual? 

A  I'm  not  sure  how  to  answer  that  question, 
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sir.      I  found  them  in  the  unallocated  space  of  the  SD 
card.      So  they  had  no  file  names.     Within  the 
(INAUDIBLE)   the  encrypted  file,   they  were  located 
within  two  SCV  files.      So  each  entry  within  those  files 
was  SigAct . 

So,    I'm  sorry  I  don't  know  how  to  answer 
that  question. 

Q  You  can't  answer  that  question  because  they 

weren't  individually  saved,  right? 

A  Correct.      It's  in  mass. 

Q  They  were  in  the  CSV  file,    right,    and  the 

CSV  file  is  associated  with  Excel .     That ' s  probably  the 
easiest  way  to  open  a  CSV  file. 

A  Correct . 

Q  Those  SigActs  you  found  weren't 

individually  downloaded? 

A  I  don ' t  know . 

Q  When  you  found  them  they  were  all  grouped 

together,  correct? 
A  Yes . 

Q  And  they  were  grouped  together  in  the  SCV 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 

184 

files,  right? 

A  Yes . 

Q  And  those  files  were  in  yada? 

A  Yes    (INAUDIBLE) . 

Q  So  the  SigAct  that  we ' re  talking  about  now 

wasn't  downloaded  with  all  of  those  or  it  wasn't  kept 
with  all  those? 

A  Right . 

Q  Those  were  all  kept  on  an  SD  card? 

A  Yes . 

Q  This  one  was  kept  on  his  personal 

Macintosh? 

A  Correct.      Sir,   but  the  dates  were  wrong. 

Q  Okay . 

A  The  dates  on  the  SD  cards  is  2009  prior. 

That  one  happened  in  2010. 

Q  So  this  was  one  that  was  completely 

separate  from  those  ones  on  the  SD  card? 

A  Correct . 

Q  Those  were  2009.      This  one  is  dated  2010? 

A  Yes . 
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Q  And  when  you  looked  at  the  volume  mounting 

data  and  you  saw  that  CIDNE— ID  number,  you  didn't  see 
other  volume  mounting  data  with  CIDNE— ID  numbers,  did 
you? 

A  Did  not . 

Q  So  there  were  no  orders  files  that  had  been 

put  on  a  CD  that  had  the  same  I  guess  naming  convention 
as  the  CIDNE-ID  number? 

A  I  did  not  see  any. 

Q  So  it  would  seem  that  this  particular 

SigAct  was  in  some  way  unique? 
A  Yes . 

Q  It  was  downloaded  and  saved  individually? 

A  Yes . 

Q  Separate  and  apart  from  all  of  the  others? 

A  It  appears  so,  yes. 

Q  I  want  to  talk  to  you  about  some  of  those 

web  pages  you  mentioned  that  you  found  when  you 
searched  the  unallocated  space  of  PFC  Manning ' s  Mac . 

A  Okay . 

Q  You  found  a  number  of  fragments  is  what 
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they  are,  correct? 

A  Correct . 

Q  And  what  you  all  did  when  you  did  your 

forensic  report,    you  and  Mr.   Johnson,   you  created 
attachments,  right? 

A  Yes. 

Q  And  one  group  of  attachments,    attachment  S, 

was  a  number  of  articles  that  implicated  Wikileaks? 
A  The  key  where  Wikileaks  was  present  in 

them. 

Q  So  anything  you  found  that  sort  of  invoked 

Wikileaks,   any  web  page  fragment  would  have  gone  into 
attachment  S,  correct? 

A  Correct . 

MR.   TOOMAN:      I'd  like  to  retrieve  Defense 
Exhibit  Kilo  Kilo  for  identification. 
BY  MR.  TOOMAN: 

Q  Agent  Shaver,   what  is  that? 

A  It ' s  a  two— page  —  it  looks  like  a 

recovered  web  page . 

Q  This  is  an  example  of  a  web  page  fragment 
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that  you  would  have  found? 
A  Yes . 

Q  Is  this  one  that  you  did  find? 

A  It  was  marked  as  such.      I  don't  recall  this 

one  specifically,   but  it  was  marked  in  accordance  the 
way  we  marked  the  files. 

Q  What  markings  in  particular  suggest  to  you 

that  this  was  one  that  you  had  found? 

A  It  has  our  case  numbers  on  it .      It  has  to 

(INAUDIBLE)    on  it,    the  foyer  LES  classification  marking 
attachment  S,   the  font's  the  same. 

Q  Now,   Agent  shaver,    I'd  like  you  to  read  on 

page  one  of  that  exhibit  for  identification  there's 
basically  a  paragraph  of  text.     Could  you  read  that, 
please? 

It  starts,   by  releasing  such  a  graphic 

video . 

A  By  releasing  such  a  graphic  video  which  a 

media  organization  has  tried  in  vein  to  get  through 
traditional  channels,   Wikileaks  has  inserted  itself  in 
the  national  discussion  about  the  role  of  journalism  in 
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the  digital  age . 

Q  You  can  stop  there . 

A  Okay . 

MR.   TOOMAN:      I'm  going  to  retrieve  Defense 
Exhibit  Kilo  Kilo  offered  as  a  Defense  exhibit . 
THE  COURT:     Any  objection. 
MAJOR  FEIN:     No,   ma'am.      It's  part  of  a 
longer  exhibit . 

THE  COURT:      I  assume  you  want  it 
separate  from  that  larger  exhibit? 

MR.   TOOMAN:     Yes,  ma'am. 
THE  COURT:      It's  admitted. 
BY  MR.  TOOMAN: 
Q  That  again  was  something  that  was  found  on 

the  unallocated  space  of  PFC  Manning's  Mac? 
A  Correct . 

Q  Which  means  at  some  point  it  was  up  on  the 

screen? 

A  Yes . 

Q  Again,    you  can't  say  for  sure  whether  or 

not  he  saw  it? 
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A  Correct . 

Q  But  it  was  up  on  the  screen? 

A  Yes . 

MR.   TOOMAN:      I'd  like  to  retrieve  Defense 
Exhibit  Lema  Lema  for  identification.     Permission  to 
publish,  ma'am. 

THE  COURT:      Go  ahead. 
BY  MR.  TOOMAN: 
Q  Sorry,    I'm  not  the  supposed  to  do  that. 

I'm  going  to  hand  this  to  the  witness. 

Agent  Shaver,   what  is  this? 
A  Again,    it  appears  to  be  another  file  from 

attachment  S  from  the  forensic  report . 
Q  How  do  you  know  that? 

A  The  markings  are  on  it . 

Q  Agent  Shaver,    I'd  like  to  direct  your 

attention  to  the  first  page,   actually  page  2. 
A  Okay . 

Q  And  there ' s  the  first  full  paragraph  that 

says  Sunshine  Press .     Would  you  read  that  please? 
A  The  full  paragraph? 
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Q  Please. 

A  The  Sunshine  Press    (Wikileaks)    is  a 

nonprofit  organization  funded  by  human  rights 
campaigners,    investigative  journalists,  technologists, 
and  the  general  public .     Through  your  support  we  have 
exposed  significant  injustice  around  the  world. 
Successfully  fighting  off  over  100    (INAUDIBLE)    in  the 
process .     Although  our  work  produces  reforms  daily  and 
it  is  the  recipient  of  numerous  prestigious  awards 
including  the  2008  index  of  censorship,    Congress  of 
Freedom  of  Expression  award  as  well  as  the  2009  NSD 
International  New  Media  Award.      These  accolades  do  not 
pay  the  bills . 

Q  You  can  stop  there,   Agent  Shaver.  Thank 

you . 

MR.  TOOMAN:  Retrieve  this  for  the  witness 
and  offer  Defense  Exhibit  Lema  Lema  as  Defense  Exhibit 
Lema  Lema . 

MAJOR  FEIN:     No  objection. 

THE  COURT:  How  many  of  these  articles  are 
we  going  to  go  through?     Can  we  show  them  all  and  have 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  7/18/13  Afternoon  Session 


191 

him  read  what  you  want  to  read  all  of  them? 

MR .   TOOMAN :      They  are  four  more . 
THE  COURT:      They're  all  admitted? 
MR.   TOOMAN:     Yes,  ma'am. 

THE  COURT :     Does  the  government  want  the 
Defense  to  go  through  a  foundation  for  each  of  these? 
MAJOR  FEIN :     Absolutely  not . 

THE  COURT :      I'm  admit  them  all ,    and  you  can 
have  the  witness  read  whatever,   attachment  S? 

MR.   TOOMAN:     Yes,  ma'am. 

THE  COURT:      So  you  have  permission  to 
publish  Exhibit  Lema  Lema  and  Defense  Exhibits  Mike 
Mike,   Defense  Exhibit  November  November,  Defense 
Exhibit  Oscar  Oscar,    and  Defense  Exhibit  Papa  Papa,  and 
they're  all  admitted. 

Captain  Tooman,   here  you  go. 

MR .   TOOMAN :      Thank  you ,   ma ' am . 

BY  MR.  TOOMAN: 
Q  I'm  going  to  hand  Mike  Mike,  November 

November,   and  Oscar  Oscar,   and  Papa  Papa  to  the 
witness . 
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A  Okay . 

Q  Agent  Shaver,    let's  look  at  Defense  Exhibit 

Mike  Mike,   and  I'd  like  you  to  look  at  page  2. 
A  Okay . 

Q  And  the  third  —  I  guess  the  fourth 

paragraph  down  starting  the  most  recent  opening? 
A  Yes . 

Q  Could  you  read  that  and  then  the  following 

paragraph,  please? 

A  Most  recent  openings  in  the  haze  of 

immediate  and  political  hypocrisy  the  near  (INAUDIBLE) 
release  of  civilian  and  of  U.S.    forces  in  the  Iraq  and 
Afghanistan.      The  now  ubiquitous  Wikileaks  video 
footage  of  soldiers  firing  on  orders  of  photographer  at 
(INAUDIBLE)    is  and  other  civilians  in  Baghdad  in 
July  2007  was  equal  and  graphic  power  by  the 
acquisitions  that  in  February  of  2010  U.S.  Special 
Forces  personnel  had  not  only  killed  two  pregnant  women 
along  with  a  teenage  girl  and  two  local  officials  in 
Kandahar  against  them  but  caused  the  bullets  out  of 
bodies  to  remove  evidence  out  of  responsibilities  for 
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their  debts. 

Q  Move  on  to  defense  Exhibit  November? 

A  Okay . 

Q  And  if  you  can  please  read  the  paragraph 

starting  with  has  become  increasing  hard  to  ignore. 

A  (INAUDIBLE)   Have  been  ignored  over  the 

years.      (INAUDIBLE)    to  some  media  watchers  far  exceeds 
that  of  even  established  news  organizations. 

Q  Thank  you .     On  to  Oscar  Oscar .     And  if  you 

could,    read  there  at  the  top  of  page  one  an  in  open 
plat form? 

A  An  open  platform  for  the  anonymous 

publishes  and  compromising  documents  according  to  Time 
Magazine.     Wikileaks  could  become  as  important  a 
journalistic  tool  as  the  Freedom  of  Information  Act . 

Q  You  can  stop  there .     And  finally  Defense 

Exhibit  Papa  Papa.      If  you  could  look  at  page  4  down 
towards  the  bottom  you  see  a  heading  collateral  murder 
in  Iraq? 

A  Yes . 

Q  The  United  States  military  video,    if  you 
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could  read  the  first  two  sentences  their  please? 

A  The  United  States  military  video  was 

released  week  showing  the  indiscriminate  targeting  and 
killing  of  civilians  in  Baghdad.      The  nonprofit  news 
organization  Wikileaks  obtained  the  video  and  made  it 
available  on  the  Internet? 

MR.   TOOMAN:      I'll  retrieve  those  exhibits 
from  the  witness . 

MAJOR  FEIN:     No  further  questions.  Thank 

you . 

THE  COURT:  Redirect. 
MAJOR  FEIN:     Yes,  ma'am. 
REDIRECT  EXAMINATION  BY  MAJOR  FEIN: 
BY  MAJOR  FEIN: 
Q  You're  almost  finished  and  possible  for  the 

whole  court . 

THE  COURT:      Is  this  going  to  be  a  long  or 
short  redirect?     I'm  looking  at  whether  we  need  a 
recess? 

MAJOR  FEIN:      Short,  ma'am. 

THE  COURT :     Why  don ' t  we  do  that .      Let ' s 
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take  a  quick  ten— minute  recess .  During  the  recess  if 
you  could  you  please,  I'd  like  for  you  to  come  see  me 
just  so  we  can  talk  about  the  way  ahead. 

The  Court  is  in  recess  until  1900  or 

7:00.  Okay. 

(Hearing  recessed  at  7:00  p.m.) 
(Hearing  resumed  at  7:10  p.m.) 
THE  COURT:      The  witness  on  the  witness 
standard.     Major  fine. 

BY  MAJOR  FEIN: 
Q  Special  Agent  Shaver  in  reference  to  your 

testimony  just  now  on  cross  examination  on  WGet  a  few 
questions .     You  testified  about  if  you  knew  the  web 
address  the  URL  for  a  specific  cable  you  can  type  that 
into  a  web  browser? 

A  Correct . 

Q  What  did  you  mean  by  that? 

A  If  you  go  to  the  address  bar,   open  a  web 

browser,    look  in  the  address  bar  and  type  that  in  as 
the  actual  path  to  the  file .     So  it  would  appear  in 
your  web  browser . 
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Q  What  program  was  installed  on  the    .22  and 

.40  computers  that  allowed  its  users  to  view  web  pages? 

A  Internet  Explorer  and  Firef ox . 

Q  And  what  program  installed  on   .22  and  .40 

allowed  individuals  to  navigate  to  web  pages  to  view 
web  pages? 

A  Internet  Explorer  and  Firef ox . 

Q  What  about  to  download,   what  program  was 

installed  on   .22  and  .40  to  allow  users  to  download? 

A  Internet  Explorer  and  Firef ox . 

Q  You  testified  about  that  it  was  possible  to 

of  having  the  NCD  web  page,   the  web  page  for  the 
database  open  in  one  window  and  running  WGet  in  the 
other.     Do  you  remember  that? 

A  Correct . 

Q  How  does  one  relate  to  the  other? 

A  Well,   besides  the  observe  that  they're  both 

running  on  the  same  computer  and  both  connecting  to  the 
State  Department,   but  otherwise  no. 

Q  Does  having  the  NCD  database  web  page  up  in 

a  browser  effect  running  WGet  get  at  all? 
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Are  they  operating  independently  of  each 
Yes ,   they ' re  independent . 

And  is  the  program  WGet  the  same  as  a  web 


No. 


A  No 

Q 

other? 

A 

Q 

browser? 
A 

Q  And  actually  now  just  direct  your  attention 

or  focus  your  testimony  on  the  SigAct  and  some  of  the 
information  you  testified  about  in  cross  examination. 

You  testified  that  you  didn't  find  any 
other  information  about  that  SigAct  on  his  personal 
Mac,  correct? 

A  Correct . 

Q  Did  you  find  any  other  information 

reference  that  go  SigAct  on  any  other  evidence  you 
examined? 

A  I  did. 

Q  Where  did  you  find  another  copy  of  that 

SigAct  in  its  entirety? 

A  Within  the  Bradley  Manning  profile  on  the 
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T-Drive . 

Q  Did  you  compare  the  two? 

A  I  did. 

Q  What  how  do  they  compare? 

A  The  one  on  T— Drive  is  the  complete . 

Q  Was  the  one? 

THE  COURT:  What. 
THE  WITNESS:      Is  complete. 
BY  MAJOR  FEIN: 
Q  And  why  is  the  other  one  not  completed? 

A  Unallocated  partially  deleted. 

Q  For  the  one  that  was  complete,   was  it  a 

individual  file  or  per  the  larger  Excel  spreadsheet? 
A  It  was  an  individual  file. 

MAJOR  FEIN:      Thank  you.     No  further 
questions,    Your  Honor. 

RECROSS  EXAMINATION  BY  MR.    TOOMAN : 
BY  MR.  TOOMAN: 
Q  Special  Agent  Shaver,   when  a  user  employs 

WGet  to  download  a  cable  and  on  is  their  computer 
forever,   whatever  place  that  they  have  it,    it's  on  the 
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computer  and  the  user  can  then  view  it,  correct? 
A  Yes . 

Q  Let's  use  our  09  Vienna  one  cable? 

A  Okay . 

Q  Hypothetical  cable .     You  download  that  with 

WGet .      That's  now  on  your  computer,  correct? 
A  Correct . 

Q  You  can  view  that  cable,  correct? 

A  Yes . 

Q  And  if  you  double  click  on  that  cable  how 

does  it  open  up? 

A  It  would  open  with  your  default  browser . 

Q  So  Internet  Explorer  or  Firefox? 

A  Correct . 

MR.   TOOMAN:     No  further  questions. 
THE  COURT:      I  don't  think  I  have  any 
questions .      Temporary  or  permanent . 

MAJOR  FEIN:     Unfortunately  for  him, 

temporary . 

THE  COURT:     You  are  temporarily  excused. 
The  same  rules  apply.     Do  not  discuss  your  testimony  or 
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your  knowledge  of  the  case  with  anyone  other  than 
counsel  or  the  accused  while  the  trial  is  still  going 
on . 


conference  about  ten  minutes  ago  to  discuss  the  way 
forward.     Understanding  the  hour,    PFC  Manning  needs  to 
eat,   we  have  additional  rebuttal  and  sire  rebuttal 
testimony  to  go  forward.      So  we're  going  to  resume 
tomorrow  morning  at  09:30. 


THE  WITNESS:      Thank  you,  ma'am. 


THE  COURT: 


I  met  with  counsel  at  a  RCM802 


Is  there  anything  else  we  need  to 


address? 


MR .   COOMBS :     No ,   Your  Honor . 


MAJOR  FEIN: 


No ,   ma ' am . 


THE  COURT: 


Court  is  in  recess  until  09:30 


tomorrow  morning . 
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